Read the docs
TI-2015-02901 Aliases CVE-2015-3280GHSA-mfmj-gwg3-vhw7

OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does…

Priority LOW 36CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-399 and the CVSS impact.

Summary

OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state.

Why it matters now

EPSS 0.03381 88th percentileScored 2026-11-07
Fix Fixed nova (PyPI): 2014.2.4, 2015.1.2Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—nova (PyPI)before 2014.2.42014.2.4Patch availableGHSA-mfmj-gwg3-vhw7
—nova (PyPI)2015.1.0 to before 2015.1.22015.1.2Patch availableGHSA-mfmj-gwg3-vhw7
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • nova (PyPI) Vendor— Affected before 2014.2.4 Fixed in 2014.2.4 Patch available GHSA-mfmj-gwg3-vhw7
  • nova (PyPI) Vendor— Affected 2015.1.0 to before 2015.1.2 Fixed in 2015.1.2 Patch available GHSA-mfmj-gwg3-vhw7

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*2014.2 to before 2014.2.4; 2015.1.0 to before 2015.1.2VulnerableOpenStack
  • cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:* Versions 2014.2 to before 2014.2.4; 2015.1.0 to before 2015.1.2 Vulnerable ·OpenStack

Remediation

  • Fix · GHSA-mfmj-gwg3-vhw7 nova (PyPI) Fixed in 2014.2.4 Advisory →
  • Fix · GHSA-mfmj-gwg3-vhw7 nova (PyPI) Fixed in 2015.1.2 Advisory →

Red Hat 1 advisory

  • RHSA-2015:1898 Released 2015-10-15 · Red Hat rating Moderate
    openstack-nova security update
    • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 openstack-nova-2014.1.5-3.el6ost, openstack-nova-api-2014.1.5-3.el6ost, openstack-nova-cells-2014.1.5-3.el6ost +12
    • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 openstack-nova-2014.1.5-5.el7ost, openstack-nova-api-2014.1.5-5.el7ost, openstack-nova-cells-2014.1.5-5.el7ost +12
    • Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 openstack-nova-2014.2.3-31.el7ost, openstack-nova-api-2014.2.3-31.el7ost, openstack-nova-cells-2014.2.3-31.el7ost +12
    • Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 openstack-nova-2015.1.1-3.el7ost, openstack-nova-api-2015.1.1-3.el7ost, openstack-nova-cells-2015.1.1-3.el7ost +13

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6Fixed RHSA-2015:1898
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7Fixed RHSA-2015:1898
Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7Fixed RHSA-2015:1898
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7Fixed RHSA-2015:1898

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-3280
  2. 2026-10-03 Alias added: GHSA-mfmj-gwg3-vhw7

References

Advisory 5

Other 5

  • TI-2026-34154 In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. CVSS 3.1HIGH 8.5
  • TI-2022-23762 An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and… CVSS 3.1MEDIUM 5.7
  • TI-2021-02596 Open redirect in openstack-nova CVSS 3.1MEDIUM 6.1
  • TI-2017-04900 An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3… CVSS 3.0CRITICAL 9.8
  • TI-2017-12516 An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. CVSS 3.0HIGH 8.6
  • TI-2020-13145 An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova… CVSS 3.1HIGH 8.3
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences