GitHub Advisoryadvisory · PyPI

GHSA-x8xr-rm9r-7mvf OpenStack Compute (Nova) has Insufficient Verification of Data Authenticity

MEDIUM Published 2022-05-14 Modified 2023-02-08 Official page ↗
Aliases
CVE-2015-0259
Ecosystem
PyPI
Packages
nova
Severity
Moderate
Weaknesses
CWE-345
Reviewed
2023-02-08

Affected packages

• PyPI nova: < 2014.1.4 → fixed in 2014.1.4 • PyPI nova: >= 2014.2.0, < 2014.2.3 → fixed in 2014.2.3

Description

OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket requests, which allows remote attackers to hijack the authentication of users for access to consoles via a crafted webpage.

Related

Alias · CVE (1)

  • CVE-2015-0259 OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket… vulnerability

Weakness · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

References