CVEvulnerability
CVE-2014-0167
6.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-04-15
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.
Affected configurations
• openstack compute 2013.1
• openstack compute 2013.1.1
• openstack compute 2013.1.2
• openstack compute 2013.1.3
• openstack compute 2013.2
• openstack compute 2013.2.1
• openstack compute 2013.2.2
• openstack compute 2013.2.3
• openstack icehouse
Related
Weakness · not in database (1)
References
- http://www.openwall.com/lists/oss-security/2014/04/09/26 Patch
- http://www.ubuntu.com/usn/USN-2247-1 www.ubuntu.com
- https://launchpad.net/bugs/1290537 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2014/04/09/26 Patch
- http://www.ubuntu.com/usn/USN-2247-1 www.ubuntu.com
- https://launchpad.net/bugs/1290537 Vendor Advisory