Open redirect in openstack-nova
Priority MEDIUM 49CWE-601Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 2 fixed, 2 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.
Summary
A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
Why it matters now
EPSS 0.26792 98th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial nova (PyPI): 21.2.3, 22.2.3, 23.0.3Red Hat: 2 advisoriesRed Hat: 2 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | openstack-nova | Affects - Nova: <21.2.3, >=22.0.0 <22.2.3, >=23.0.0 <23.0.3 | Fixed-In 21.2.3, 22.3.0, and 23.1.0 | — | No fix listed | CNA |
| — | nova (PyPI) | before 21.2.3 | 21.2.3 | Patch available | GHSA-vqp6-j452-j6wp |
| — | nova (PyPI) | 22.0.0 to before 22.2.3 | 22.2.3 | Patch available | GHSA-vqp6-j452-j6wp |
| — | nova (PyPI) | 23.0.0 to before 23.0.3 | 23.0.3 | Patch available | GHSA-vqp6-j452-j6wp |
- openstack-nova Vendor— Affected Affects - Nova: <21.2.3, >=22.0.0 <22.2.3, >=23.0.0 <23.0.3 | Fixed-In 21.2.3, 22.3.0, and 23.1.0 Fixed in — No fix listed CNA
- nova (PyPI) Vendor— Affected before 21.2.3 Fixed in 21.2.3 Patch available GHSA-vqp6-j452-j6wp
- nova (PyPI) Vendor— Affected 22.0.0 to before 22.2.3 Fixed in 22.2.3 Patch available GHSA-vqp6-j452-j6wp
- nova (PyPI) Vendor— Affected 23.0.0 to before 23.0.3 Fixed in 23.0.3 Patch available GHSA-vqp6-j452-j6wp
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:* | before 21.2.3; 22.0.0 to before 22.2.3; 23.0.0 to before 23.0.3 | Vulnerable | OpenStack |
| cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:* | 16.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:* | 16.2 | Vulnerable | Red Hat |
- cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:* Versions before 21.2.3; 22.0.0 to before 22.2.3; 23.0.0 to before 23.0.3 Vulnerable ·OpenStack
- cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:* Versions 16.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:* Versions 16.2 Vulnerable ·Red Hat
Remediation
- Fix · GHSA-vqp6-j452-j6wp nova (PyPI) Fixed in 21.2.3 Advisory →
- Fix · GHSA-vqp6-j452-j6wp nova (PyPI) Fixed in 22.2.3 Advisory →
- Fix · GHSA-vqp6-j452-j6wp nova (PyPI) Fixed in 23.0.3 Advisory →
Red Hat 2 advisories
- RHSA-2022:0983 Released 2022-03-24 · Red Hat rating ModerateRed Hat OpenStack Platform 16.1 (openstack-nova) security update
- Red Hat OpenStack Platform 16.1 openstack-nova-1:20.4.1-1.20220112153422.1ee93b9.el8ost, openstack-nova-api-1:20.4.1-1.20220112153422.1ee93b9.el8ost, openstack-nova-common-1:20.4.1-1.20220112153422.1ee93b9.el8ost +9
- RHSA-2022:0999 Released 2022-03-23 · Red Hat rating ModerateRed Hat OpenStack Platform 16.2 (openstack-nova) security update
- Red Hat OpenStack Platform 16.2 openstack-nova-1:20.6.2-2.20220112164912.8906554.el8ost, openstack-nova-api-1:20.6.2-2.20220112164912.8906554.el8ost, openstack-nova-common-1:20.6.2-2.20220112164912.8906554.el8ost +9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 16.1 | Fixed | RHSA-2022:0983 |
| Red Hat OpenStack Platform 16.2 | Fixed | RHSA-2022:0999 |
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3654
- 2026-10-03 Alias added: GHSA-vqp6-j452-j6wp
References
Patch 6
- https://security.openstack.org/ossa/OSSA-2021-002.html
- https://www.openwall.com/lists/oss-security/2021/07/29/2
- https://bugs.python.org/issue32084
- https://opendev.org/openstack/nova/commit/04d48527b62a35d912f93bc75613a6cca606df66
- https://opendev.org/openstack/nova/commit/8906552cfc2525a44251d4cf313ece61e57251eb
- https://bugzilla.redhat.com/show_bug.cgi?id=1961439
Sources
- CVE-2021-3654 · CVE Program
- CVE-2021-3654 · NVD
- FIRST EPSS
- GHSA-vqp6-j452-j6wp · GitHub Advisory Database · CC BY 4.0
- CVE-2021-3654 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences