Read the docs
TI-2015-02870 Aliases CVE-2015-3241GHSA-3vx7-xff6-h2vx

OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the…

Priority LOW 36CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-399 and the CVSS impact.

Summary

OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the migration process when the instance is deleted, which allows remote authenticated users to cause a denial of service (disk, network, and other resource consumption) by resizing and then deleting an instance.

Why it matters now

EPSS 0.0348 89th percentileScored 2026-11-07
Fix Fixed nova (PyPI): 112.0.0.0b3Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—nova (PyPI)before 112.0.0.0b3112.0.0.0b3Patch availableGHSA-3vx7-xff6-h2vx
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • nova (PyPI) Vendor— Affected before 112.0.0.0b3 Fixed in 112.0.0.0b3 Patch available GHSA-3vx7-xff6-h2vx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*2014.2 – 2014.2.3; 2015.1.0 – 2015.1.1VulnerableOpenStack
  • cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:* Versions 2014.2 – 2014.2.3; 2015.1.0 – 2015.1.1 Vulnerable ·OpenStack

Remediation

  • Fix · GHSA-3vx7-xff6-h2vx nova (PyPI) Fixed in 112.0.0.0b3 Advisory →

Red Hat 2 advisories

  • RHSA-2015:1898 Released 2015-10-15 · Red Hat rating Moderate
    openstack-nova security update
    • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 openstack-nova-2014.1.5-3.el6ost, openstack-nova-api-2014.1.5-3.el6ost, openstack-nova-cells-2014.1.5-3.el6ost +12
    • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 openstack-nova-2014.1.5-5.el7ost, openstack-nova-api-2014.1.5-5.el7ost, openstack-nova-cells-2014.1.5-5.el7ost +12
    • Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 openstack-nova-2014.2.3-31.el7ost, openstack-nova-api-2014.2.3-31.el7ost, openstack-nova-cells-2014.2.3-31.el7ost +12
    • Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 openstack-nova-2015.1.1-3.el7ost, openstack-nova-api-2015.1.1-3.el7ost, openstack-nova-cells-2015.1.1-3.el7ost +13
  • RHSA-2015:1723 Released 2015-09-03 · Red Hat rating Moderate
    openstack-nova security update
    • Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 openstack-nova-2015.1.0-18.el7ost, openstack-nova-api-2015.1.0-18.el7ost, openstack-nova-cells-2015.1.0-18.el7ost +13

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6Fixed RHSA-2015:1898
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7Fixed RHSA-2015:1898
Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7Fixed RHSA-2015:1898
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7Fixed RHSA-2015:1723, RHSA-2015:1898

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-3241
  2. 2026-10-03 Alias added: GHSA-3vx7-xff6-h2vx

References

Advisory 6

Other 8

  • TI-2026-34154 In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. CVSS 3.1HIGH 8.5
  • TI-2022-23762 An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and… CVSS 3.1MEDIUM 5.7
  • TI-2021-02596 Open redirect in openstack-nova CVSS 3.1MEDIUM 6.1
  • TI-2017-04900 An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3… CVSS 3.0CRITICAL 9.8
  • TI-2017-12516 An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. CVSS 3.0HIGH 8.6
  • TI-2020-13145 An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova… CVSS 3.1HIGH 8.3
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences