GitHub Advisory DatabaseGHSA-JV34-XVJQ-PPCHOpenStack Nova VMWare driver leaks rescued images
6.8 Medium
AI Score
Confidence
Low
2.3 Low
CVSS2
Access Vector
Access Complexity
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:A/AC:M/Au:S/C:N/I:N/A:P
0.003 Low
EPSS
Percentile
69.2%
The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image.
Affected configurations
References
secunia.com/advisories/57498
www.openwall.com/lists/oss-security/2014/03/21/1
www.openwall.com/lists/oss-security/2014/03/21/2
bugs.launchpad.net/nova/+bug/1269418
github.com/advisories/GHSA-jv34-xvjq-ppch
github.com/openstack/nova/commit/b3cc3f62a60662e5bb82136c0cfa464592a6afe9
github.com/openstack/nova/commit/efb66531bc37ee416778a70d46c657608ca767af
nvd.nist.gov/vuln/detail/CVE-2014-2573
Related
6.8 Medium
AI Score
Confidence
Low
2.3 Low
CVSS2
Access Vector
Access Complexity
Authentication
SINGLE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:A/AC:M/Au:S/C:N/I:N/A:P
0.003 Low
EPSS
Percentile
69.2%