CVSS: 4.0EPSS: 0%CPEs: 2EXPL: 1CVE-2014-3608 – openstack-nova: incomplete fix for CVE-2014-2573, Nova VMware driver still leaks rescued images
https://notcve.org/view.php?id=CVE-2014-3608
The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by putting the VM into the rescue state, suspending it, which puts into an ERROR state, and then deleting the image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2573. El controlador VMWare en OpenStack Compute (Nova) anterior a 2014.1.3 permite a usuarios remotos autenticados evadir la límite de la cuota y causar una denegación de servicio (consumo de recursos) mediante la colocación del VM en el estado de rescate, su suspensión, lo que entra en un estado de ERROR, y posteriormente la eliminación de la imagen. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2014-2573. • http://rhn.redhat.com/errata/RHSA-2014-1781.html http://rhn.redhat.com/errata/RHSA-2014-1782.html http://seclists.org/oss-sec/2014/q4/65 http://www.securityfocus.com/bid/70220 https://bugs.launchpad.net/nova/+bug/1338830 https://access.redhat.com/security/cve/CVE-2014-3608 https://bugzilla.redhat.com/show_bug.cgi?id=1148253 • CWE-399: Resource Management Errors CWE-400: Uncontrolled Resource Consumption •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 0CVE-2014-3517 – openstack-nova: timing attack issue allows access to other instances' configuration information
https://notcve.org/view.php?id=CVE-2014-3517
api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying metadata requests through Neutron, makes it easier for remote attackers to guess instance ID signatures via a brute-force attack that relies on timing differences in responses to instance metadata requests. api/metadata/handler.py en OpenStack Compute (Nova) anterior a 2013.2.4, 2014.x anterior a 2014.1.2 y Juno anterior a Juno-2, cuando redirige las solicitudes de metadatos a través de Neutron, facilita a atacantes remotos adivinar las firmas de ID de instancia a través de un ataque de fuerza bruta que se basa en las diferencias de tiempo en las respuestas a las solicitudes de metadatos de la instancia. A side-channel timing attack flaw was found in Nova. An attacker could possibly use this flaw to guess valid instance ID signatures, giving them access to details of another instance, by analyzing the response times of requests for instance metadata. This issue only affected configurations that proxy metadata requests via Neutron. • http://www.openwall.com/lists/oss-security/2014/07/17/2 https://bugs.launchpad.net/nova/+bug/1325128 https://access.redhat.com/security/cve/CVE-2014-3517 https://bugzilla.redhat.com/show_bug.cgi?id=1112499 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-385: Covert Timing Channel •
CVSS: 4.0EPSS: 0%CPEs: 3EXPL: 0CVE-2013-6437 – openstack-nova: DoS through ephemeral disk backing files
https://notcve.org/view.php?id=CVE-2013-6437
The libvirt driver in OpenStack Compute (Nova) before 2013.2.2 and icehouse before icehouse-2 allows remote authenticated users to cause a denial of service (disk consumption) by creating and deleting instances with unique os_type settings, which triggers the creation of a new ephemeral disk backing file. El controlador libvirt en OpenStack Compute (Nova) anterior a 2013.2.2 y icehouse anterior a icehouse-2 permite a usuarios remotos autenticados causar una denegación de servicio (consumo de disco) mediante creación y eliminación de instancias con configuraciones os_type únicas, lo que provoca la creación de un archivo de respaldo de disco efímero nuevo. • http://lists.openstack.org/pipermail/openstack-announce/2013-December/000179.html http://rhn.redhat.com/errata/RHSA-2014-0231.html https://bugs.launchpad.net/nova/+bug/1253980 https://access.redhat.com/security/cve/CVE-2013-6437 https://bugzilla.redhat.com/show_bug.cgi?id=1043106 • CWE-399: Resource Management Errors •
CVSS: 5.8EPSS: 0%CPEs: 2EXPL: 1CVE-2013-7048 – Nova: insecure directory permissions in snapshots
https://notcve.org/view.php?id=CVE-2013-7048
OpenStack Compute (Nova) Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary directory used to store live snapshots, which allows local users to read and modify live snapshots. OpenStack Compute (Nova) Grizzly 2013.1.4,, La Habana 2013.2.1, y anteriores utilizan con permiso de escritura y lectura universal para el directorio temporal usado para almacenar las instantáneas en vivo (snapshots), lo que permite a usuarios locales leer y modificar instantáneas en vivo (snapshots). • http://rhn.redhat.com/errata/RHSA-2014-0231.html http://www.openwall.com/lists/oss-security/2014/01/13/2 https://bugs.launchpad.net/nova/+bug/1227027 https://access.redhat.com/security/cve/CVE-2013-7048 https://bugzilla.redhat.com/show_bug.cgi?id=1040786 • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 6.0EPSS: 0%CPEs: 2EXPL: 1CVE-2013-2256 – OpenStack: Nova private flavors resource limit circumvention
https://notcve.org/view.php?id=CVE-2013-2256
OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id. OpenStack Compute (Nova) anterior a 2013.1.3 y Havana anterior havana-2 no fuerza apropiadamente la propiedad "os-flavor-access:is_public" lo que permite a usuarios remotos autenticados obtener información sensible sobre (propiedades flavor) , opciones de arranque y posiblemente otros impactos adivinando el "flavor id" • http://rhn.redhat.com/errata/RHSA-2013-1199.html http://seclists.org/oss-sec/2013/q3/281 https://bugs.launchpad.net/nova/+bug/1194093 https://access.redhat.com/security/cve/CVE-2013-2256 https://bugzilla.redhat.com/show_bug.cgi?id=993340 • CWE-264: Permissions, Privileges, and Access Controls CWE-862: Missing Authorization •