Read the docs
TI-2015-02371 Aliases CVE-2015-2687GHSA-97fv-22hc-mrgj

OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local…

Priority LOW 22CWE-284Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 3 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284.

Summary

OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normally not have permissions for.

Why it matters now

EPSS 0.0034 27th percentileScored 2026-11-07
Fix Partial nova (PyPI): 15.0.0.0b1Red Hat: 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—nova (PyPI)before 15.0.0.0b115.0.0.0b1Patch availableGHSA-97fv-22hc-mrgj
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • nova (PyPI) Vendor— Affected before 15.0.0.0b1 Fixed in 15.0.0.0b1 Patch available GHSA-97fv-22hc-mrgj

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:openstack:compute:2013.2:*:*:*:*:*:*:*2013.2VulnerableOpenStack
cpe:2.3:a:openstack:compute:2013.2.1:*:*:*:*:*:*:*2013.2.1VulnerableOpenStack
cpe:2.3:a:openstack:compute:2013.2.2:*:*:*:*:*:*:*2013.2.2VulnerableOpenStack
cpe:2.3:a:openstack:compute:2013.2.3:*:*:*:*:*:*:*2013.2.3VulnerableOpenStack
cpe:2.3:a:openstack:compute:2013.2.4:*:*:*:*:*:*:*2013.2.4VulnerableOpenStack
cpe:2.3:a:openstack:compute:2014.1:*:*:*:*:*:*:*2014.1VulnerableOpenStack
cpe:2.3:a:openstack:compute:2014.1.1:*:*:*:*:*:*:*2014.1.1VulnerableOpenStack
cpe:2.3:a:openstack:compute:2014.1.2:*:*:*:*:*:*:*2014.1.2VulnerableOpenStack
cpe:2.3:a:openstack:compute:2014.1.3:*:*:*:*:*:*:*2014.1.3VulnerableOpenStack
cpe:2.3:a:openstack:compute:2014.1.4:*:*:*:*:*:*:*2014.1.4VulnerableOpenStack
  • cpe:2.3:a:openstack:compute:2013.2:*:*:*:*:*:*:* Versions 2013.2 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:compute:2013.2.1:*:*:*:*:*:*:* Versions 2013.2.1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:compute:2013.2.2:*:*:*:*:*:*:* Versions 2013.2.2 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:compute:2013.2.3:*:*:*:*:*:*:* Versions 2013.2.3 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:compute:2013.2.4:*:*:*:*:*:*:* Versions 2013.2.4 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:compute:2014.1:*:*:*:*:*:*:* Versions 2014.1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:compute:2014.1.1:*:*:*:*:*:*:* Versions 2014.1.1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:compute:2014.1.2:*:*:*:*:*:*:* Versions 2014.1.2 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:compute:2014.1.3:*:*:*:*:*:*:* Versions 2014.1.3 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:compute:2014.1.4:*:*:*:*:*:*:* Versions 2014.1.4 Vulnerable ·OpenStack
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:openstack:compute:2014.1.5:*:*:*:*:*:*:*2014.1.5VulnerableOpenStack
cpe:2.3:a:openstack:compute:2014.2:*:*:*:*:*:*:*2014.2VulnerableOpenStack
cpe:2.3:a:openstack:compute:2014.2.1:*:*:*:*:*:*:*2014.2.1VulnerableOpenStack
cpe:2.3:a:openstack:compute:2014.2.2:*:*:*:*:*:*:*2014.2.2VulnerableOpenStack
cpe:2.3:a:openstack:compute:2014.2.3:*:*:*:*:*:*:*2014.2.3VulnerableOpenStack
cpe:2.3:a:openstack:compute:2014.2.4:*:*:*:*:*:*:*2014.2.4VulnerableOpenStack
  • cpe:2.3:a:openstack:compute:2014.1.5:*:*:*:*:*:*:* Versions 2014.1.5 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:compute:2014.2:*:*:*:*:*:*:* Versions 2014.2 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:compute:2014.2.1:*:*:*:*:*:*:* Versions 2014.2.1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:compute:2014.2.2:*:*:*:*:*:*:* Versions 2014.2.2 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:compute:2014.2.3:*:*:*:*:*:*:* Versions 2014.2.3 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:compute:2014.2.4:*:*:*:*:*:*:* Versions 2014.2.4 Vulnerable ·OpenStack

Remediation

  • Fix · GHSA-97fv-22hc-mrgj nova (PyPI) Fixed in 15.0.0.0b1 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux OpenStack Platform 6 (Juno)AffectedNo fix yet: Fix deferred
Red Hat OpenStack Platform 4AffectedNo fix planned: Will not fix

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-2687
  2. 2026-10-03 Alias added: GHSA-97fv-22hc-mrgj

References

Advisory 6

Other 4

  • TI-2013-05849 The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver… CVSS 2.0HIGH 7.1
  • TI-2014-00161 The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before… CVSS 2.0MEDIUM 6.0
  • TI-2013-02015 Improper certificate validation in OpenStack Keystone CVSS 3.1MEDIUM 5.9
  • TI-2013-03652 The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before… CVSS 2.0MEDIUM 4.3
  • TI-2012-02292 The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1)… CVSS 2.0MEDIUM 4.3
  • TI-2013-03658 Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and… CVSS 2.0MEDIUM 4.0
See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences