CVEvulnerability
CVE-2012-2654
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2012-06-21
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-20
Description
The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.
Affected configurations
• openstack compute 2012.2
• openstack diablo 2011.3
• openstack essex 2012.1
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://secunia.com/advisories/46808 Vendor Advisory
- http://secunia.com/advisories/49439 Vendor Advisory
- http://www.ubuntu.com/usn/USN-1466-1 www.ubuntu.com
- https://bugs.launchpad.net/nova/+bug/985184 Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76110 exchange.xforce.ibmcloud.com
- https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09beac2978 Exploit, Patch
- https://github.com/openstack/nova/commit/ff06c7c885dc94ed7c828e8cdbb8b5d850a7e654 Exploit, Patch
- https://lists.launchpad.net/openstack/msg12883.html lists.launchpad.net
- https://review.openstack.org/#/c/8239/ review.openstack.org
- http://secunia.com/advisories/46808 Vendor Advisory
- http://secunia.com/advisories/49439 Vendor Advisory
- http://www.ubuntu.com/usn/USN-1466-1 www.ubuntu.com
- https://bugs.launchpad.net/nova/+bug/985184 Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76110 exchange.xforce.ibmcloud.com
- https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09beac2978 Exploit, Patch
- https://github.com/openstack/nova/commit/ff06c7c885dc94ed7c828e8cdbb8b5d850a7e654 Exploit, Patch
- https://lists.launchpad.net/openstack/msg12883.html lists.launchpad.net
- https://review.openstack.org/#/c/8239/ review.openstack.org