GitHub Advisoryadvisory · PyPI

GHSA-xjmj-p278-4jp5 OpenStack Compute (Nova) Exposure of Sensitive Information to an Unauthorized Actor vulnerability

MEDIUM Published 2022-05-14 Modified 2023-02-08 Official page ↗
Aliases
CVE-2014-3517
Ecosystem
PyPI
Packages
nova
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2023-02-08

Affected packages

• PyPI nova: < 2013.2.4 → fixed in 2013.2.4 • PyPI nova: >= 2014.0.0, < 2014.1.2 → fixed in 2014.1.2

Description

api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying metadata requests through Neutron, makes it easier for remote attackers to guess instance ID signatures via a brute-force attack that relies on timing differences in responses to instance metadata requests.

Related

Alias · CVE (1)

  • CVE-2014-3517 api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying metadata… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References