Read the docs
TI-2015-06409 Aliases CVE-2015-7713GHSA-67rh-9p29-vrxr

OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do…

Priority LOW 29CWE-254Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Partial · None
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made.

Why it matters now

EPSS 0.037 89th percentileScored 2026-11-07
Fix Fixed nova (PyPI): 2014.2.4, 2015.1.2Red Hat: 4 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—nova (PyPI)before 2014.2.42014.2.4Patch availableGHSA-67rh-9p29-vrxr
—nova (PyPI)2015.1.0 to before 2015.1.22015.1.2Patch availableGHSA-67rh-9p29-vrxr
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • nova (PyPI) Vendor— Affected before 2014.2.4 Fixed in 2014.2.4 Patch available GHSA-67rh-9p29-vrxr
  • nova (PyPI) Vendor— Affected 2015.1.0 to before 2015.1.2 Fixed in 2015.1.2 Patch available GHSA-67rh-9p29-vrxr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*2014.2 to before 2014.2.4; 2015.1.0 to before 2015.1.2VulnerableOpenStack
  • cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:* Versions 2014.2 to before 2014.2.4; 2015.1.0 to before 2015.1.2 Vulnerable ·OpenStack

Remediation

  • Fix · GHSA-67rh-9p29-vrxr nova (PyPI) Fixed in 2014.2.4 Advisory →
  • Fix · GHSA-67rh-9p29-vrxr nova (PyPI) Fixed in 2015.1.2 Advisory →

Red Hat 4 advisories

  • RHSA-2016:0017 Released 2016-01-10 · Red Hat rating Important
    openstack-nova security advisory
    • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 openstack-nova-2014.1.5-16.el6ost, openstack-nova-api-2014.1.5-16.el6ost, openstack-nova-cells-2014.1.5-16.el6ost +12
  • RHSA-2016:0013 Released 2016-01-07 · Red Hat rating Moderate
    openstack-nova security and bug fix advisory
    • Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 openstack-nova-2014.2.3-42.el7ost, openstack-nova-api-2014.2.3-42.el7ost, openstack-nova-cells-2014.2.3-42.el7ost +12
  • RHSA-2015:2684 Released 2015-12-21 · Red Hat rating Moderate
    openstack-nova secuity and bug fix advisory
    • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 openstack-nova-2014.1.5-9.el7ost, openstack-nova-api-2014.1.5-9.el7ost, openstack-nova-cells-2014.1.5-9.el7ost +12
Show 1 more Red Hat advisories
  • RHSA-2015:2673 Released 2015-12-21 · Red Hat rating Moderate
    openstack-nova security and bug fix advisory
    • OpenStack 7.0 Tools for RHEL 7 python-novaclient-1:2.23.0-2.el7ost, python-novaclient-doc-1:2.23.0-2.el7ost
    • Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 openstack-nova-2015.1.2-7.el7ost, openstack-nova-api-2015.1.2-7.el7ost, openstack-nova-cells-2015.1.2-7.el7ost +15

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenStack 7.0 Tools for RHEL 7Fixed RHSA-2015:2673
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6Fixed RHSA-2016:0017
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7Fixed RHSA-2015:2684
Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7Fixed RHSA-2016:0013
Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7Fixed RHSA-2015:2673

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-7713
  2. 2026-10-03 Alias added: GHSA-67rh-9p29-vrxr

References

Advisory 6

Other 7

  • TI-2026-34154 In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. CVSS 3.1HIGH 8.5
  • TI-2022-23762 An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and… CVSS 3.1MEDIUM 5.7
  • TI-2021-02596 Open redirect in openstack-nova CVSS 3.1MEDIUM 6.1
  • TI-2017-04900 An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3… CVSS 3.0CRITICAL 9.8
  • TI-2017-12516 An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. CVSS 3.0HIGH 8.6
  • TI-2020-13145 An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova… CVSS 3.1HIGH 8.3
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences