GitHub Advisoryadvisory · PyPI

GHSA-qr62-r9xc-r2gj OpenStack Nova Multiple directory traversal vulnerabilities

MEDIUM Published 2022-05-14 Modified 2024-05-14 Official page ↗
Aliases
CVE-2011-4596
Ecosystem
PyPI
Packages
nova
Severity
Moderate
Weaknesses
CWE-22
Reviewed
2024-05-14

Affected packages

• PyPI nova: < 12.0.0a0 → fixed in 12.0.0a0

Description

Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary files via a crafted (1) tarball or (2) manifest.

Related

Alias · CVE (1)

  • CVE-2011-4596 Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References