Read the docs
TI-2020-13145 Aliases CVE-2020-17376GHSA-c7w7-9c85-4qxv

An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova…

Priority MEDIUM 40CWE-611Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
Partial Red Hat: 6 fixed, 1 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source host. This can include block devices that map to different Cinder volumes at the destination than at the source. Only deployments allowing host-based connections (for instance, root and ephemeral devices) are affected.

Why it matters now

EPSS 0.01763 78th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial nova (PyPI): 19.3.1, 20.3.1Red Hat: 5 advisoriesRed Hat: 6 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—nova (PyPI)before 19.3.119.3.1Patch availableGHSA-c7w7-9c85-4qxv
—nova (PyPI)20.0.0 to before 20.3.120.3.1Patch availableGHSA-c7w7-9c85-4qxv
—nova (PyPI)——No fix listedGHSA-c7w7-9c85-4qxv
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • nova (PyPI) Vendor— Affected before 19.3.1 Fixed in 19.3.1 Patch available GHSA-c7w7-9c85-4qxv
  • nova (PyPI) Vendor— Affected 20.0.0 to before 20.3.1 Fixed in 20.3.1 Patch available GHSA-c7w7-9c85-4qxv
  • nova (PyPI) Vendor— Affected — Fixed in — No fix listed GHSA-c7w7-9c85-4qxv

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*before 19.3.1; 20.0.0 to before 20.3.1VulnerableOpenStack
cpe:2.3:a:openstack:nova:21.0.0:*:*:*:*:*:*:*21.0.0VulnerableOpenStack
  • cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:* Versions before 19.3.1; 20.0.0 to before 20.3.1 Vulnerable ·OpenStack
  • cpe:2.3:a:openstack:nova:21.0.0:*:*:*:*:*:*:* Versions 21.0.0 Vulnerable ·OpenStack

Remediation

  • Fix · GHSA-c7w7-9c85-4qxv nova (PyPI) Fixed in 19.3.1 Advisory →
  • Fix · GHSA-c7w7-9c85-4qxv nova (PyPI) Fixed in 20.3.1 Advisory →

Red Hat 5 advisories

  • RHSA-2020:3711 Released 2020-09-10 · Red Hat rating Important
    openstack-nova security update
    • Red Hat OpenStack Platform 10.0 openstack-nova-1:14.1.0-65.el7ost, openstack-nova-api-1:14.1.0-65.el7ost, openstack-nova-cells-1:14.1.0-65.el7ost +14
  • RHSA-2020:3708 Released 2020-09-10 · Red Hat rating Important
    openstack-nova security update
    • Red Hat OpenStack Platform 13.0 openstack-nova-1:17.0.13-24.el7ost, openstack-nova-api-1:17.0.13-24.el7ost, openstack-nova-cells-1:17.0.13-24.el7ost +13
    • Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server openstack-nova-1:17.0.13-24.el7ost, openstack-nova-api-1:17.0.13-24.el7ost, openstack-nova-cells-1:17.0.13-24.el7ost +13
  • RHSA-2020:3706 Released 2020-09-10 · Red Hat rating Important
    openstack-nova security update
    • Red Hat OpenStack Platform 15.0 openstack-nova-1:19.1.0-0.20200207070459.bf9d9e5.el8ost, openstack-nova-api-1:19.1.0-0.20200207070459.bf9d9e5.el8ost, openstack-nova-cells-1:19.1.0-0.20200207070459.bf9d9e5.el8ost +11
Show 2 more Red Hat advisories
  • RHSA-2020:3704 Released 2020-09-10 · Red Hat rating Important
    openstack-nova security update
    • Red Hat OpenStack Platform 16.0 openstack-nova-1:20.1.2-0.20200401205215.28324e6.el8ost, openstack-nova-api-1:20.1.2-0.20200401205215.28324e6.el8ost, openstack-nova-common-1:20.1.2-0.20200401205215.28324e6.el8ost +9
  • RHSA-2020:3702 Released 2020-09-10 · Red Hat rating Important
    openstack-nova security update
    • Red Hat OpenStack Platform 16.1 openstack-nova-1:20.3.1-0.20200626213436.38ee1f3.el8ost, openstack-nova-api-1:20.3.1-0.20200626213436.38ee1f3.el8ost, openstack-nova-common-1:20.3.1-0.20200626213436.38ee1f3.el8ost +9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 16.2AffectedNo fix yet
Red Hat OpenStack Platform 10.0Fixed RHSA-2020:3711
Red Hat OpenStack Platform 13.0Fixed RHSA-2020:3708
Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS ServerFixed RHSA-2020:3708
Red Hat OpenStack Platform 15.0Fixed RHSA-2020:3706
Red Hat OpenStack Platform 16.0Fixed RHSA-2020:3704
Red Hat OpenStack Platform 16.1Fixed RHSA-2020:3702
Not affected: 2 products
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-17376
  2. 2026-10-03 Alias added: GHSA-c7w7-9c85-4qxv
  3. 2026-10-07 Affected versions changed · Red Hat
  4. 2026-10-08 Affected versions changed · Red Hat

References

Exploit 1

Patch 2

Advisory 1

Other 7

  • TI-2026-34154 In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. CVSS 3.1HIGH 8.5
  • TI-2022-23762 An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and… CVSS 3.1MEDIUM 5.7
  • TI-2021-02596 Open redirect in openstack-nova CVSS 3.1MEDIUM 6.1
  • TI-2017-04900 An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3… CVSS 3.0CRITICAL 9.8
  • TI-2017-12516 An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. CVSS 3.0HIGH 8.6
  • TI-2017-13376 An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. CVSS 3.0HIGH 7.5
See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences