Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-W2WF-CGWH-VPQG
HistoryMay 13, 2022 - 1:44 a.m.

OpenStack Nova Filter Scheduler Bypass

2022-05-1301:44:04
GitHub Advisory Database
github.com
7
openstack
nova
filter scheduler
bypass
vulnerability
instance
rebuild
authenticated user
circumvent
regression
launchpad bug #1732947
fix
software

CVSS2

4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

48.6%

JSON

In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Because of the regression described in Launchpad Bug #1732947, the preferred fix is a 14.x version after 14.0.10, a 15.x version after 15.0.8, or a 16.x version after 16.0.3.

Affected configurations

Vulners
Node
novanovaRange14.0.0–14.0.10
OR
novanovaRange15.0.0–15.0.8
OR
novanovaRange16.0.0–16.0.3
VendorProductVersionCPE
novanova*cpe:2.3:a:nova:nova:*:*:*:*:*:*:*:*

Related

cvelist 2
nessus 4
nvd 2
redhatcve 2
ibm 2
osv 3
redhat 3
debian 1
prion 2
ubuntucve 2
veracode 1
debiancve 2
openvas 1
cve 2
github 1
cvelist
cvelist
CVE-2017-16239
2017-11-14 17:00:00
CVE-2017-17051
2017-12-05 18:00:00
nessus
nessus
RHEL 7 : openstack-nova (RHSA-2018:0314)
2024-04-27 00:00:00
RHEL 7 : openstack-nova (RHSA-2018:0241)
2024-04-27 00:00:00
RHEL 7 : openstack-nova and python-novaclient (RHSA-2018:0369)
2024-04-27 00:00:00
nvd
nvd
CVE-2017-16239
2017-11-14 17:29:00
CVE-2017-17051
2017-12-05 18:29:00
redhatcve
redhatcve
CVE-2017-16239
2017-11-14 22:49:37
CVE-2017-17051
2017-12-05 21:50:14
ibm
ibm
Security Bulletin: IBM Cloud Manager with OpenStack is affected by an OpenStack Nova vulnerability
2018-08-08 04:13:55
Security Bulletin: Nova Filter Scheduler bypass through rebuild action (CVE-2017-16239)
2018-06-18 00:02:09
osv
osv
CVE-2017-16239
2017-11-14 17:29:00
nova - security update
2017-12-07 00:00:00
CVE-2017-17051
2017-12-05 18:29:00
redhat
redhat
(RHSA-2018:0369) Moderate: openstack-nova and python-novaclient security, bug fix, and enhancement update
2018-02-27 16:07:00
(RHSA-2018:0241) Moderate: openstack-nova security and bug fix update
2018-01-30 18:29:51
(RHSA-2018:0314) Moderate: openstack-nova security and bug fix update
2018-02-13 16:04:41
debian
debian
[SECURITY] [DSA 4056-1] nova security update
2017-12-07 11:39:33
prion
prion
Design/Logic Flaw
2017-11-14 17:29:00
Default credentials
2017-12-05 18:29:00
ubuntucve
ubuntucve
CVE-2017-16239
2017-11-14 00:00:00
CVE-2017-17051
2017-12-05 00:00:00
veracode
veracode
Authorization Bypass
2019-01-15 09:20:48
debiancve
debiancve
CVE-2017-16239
2017-11-14 17:29:00
CVE-2017-17051
2017-12-05 18:29:00
openvas
openvas
Debian: Security Advisory (DSA-4056-1)
2017-12-06 00:00:00
cve
cve
CVE-2017-16239
2017-11-14 17:29:00
CVE-2017-17051
2017-12-05 18:29:00
github
github
OpenStack Nova DoS by rebuilding the same instance with a new image multiple times
2022-05-13 01:44:15

CVSS2

4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

AI Score

6.9

Confidence

Low

EPSS

0.001

Percentile

48.6%

JSON
Related for GHSA-W2WF-CGWH-VPQG
cvelist2nessus4nvd2redhatcve2ibm2osv3redhat3debian1prion2ubuntucve2veracode1debiancve2openvas1cve2github1