GitHub Advisoryadvisory · PyPI
GHSA-jv34-xvjq-ppch OpenStack Nova VMWare driver leaks rescued images
HIGH
Official page ↗
- Aliases
- CVE-2014-2573
- Ecosystem
- PyPI
- Packages
- nova
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-770
- Reviewed
- 2024-05-14
Affected packages
• PyPI nova: < 12.0.0a0 → fixed in 12.0.0a0
Description
The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image.
Related
Alias · CVE (1)
- CVE-2014-2573 The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote… vulnerability
Weakness · CWE (1)
- CWE-770 Allocation of Resources Without Limits or Throttling weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-2573 advisory
- https://github.com/openstack/nova/commit/b3cc3f62a60662e5bb82136c0cfa464592a6afe9 web
- https://github.com/openstack/nova/commit/efb66531bc37ee416778a70d46c657608ca767af web
- https://bugs.launchpad.net/nova/+bug/1269418 web
- https://github.com/openstack/nova package
- https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2014-113.yaml web
- http://www.openwall.com/lists/oss-security/2014/03/21/1 web
- http://www.openwall.com/lists/oss-security/2014/03/21/2 web