Lucene search

K
githubGitHub Advisory DatabaseGHSA-W429-XC55-HC48
HistoryMay 17, 2022 - 4:41 a.m.

OpenStack Nova host data leak to vm instance in rescue mode

2022-05-1704:41:34
CWE-200
GitHub Advisory Database
github.com
3

6.7 Medium

AI Score

Confidence

Low

3.5 Low

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

49.6%

The instance rescue mode in OpenStack Compute (Nova) 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images and use_cow_images is set to false, allows remote authenticated users to read certain compute host files by overwriting an instance disk with a crafted image.

Affected configurations

Vulners
Node
github_advisory_databasenovaRange<12.0.0a0
CPENameOperatorVersion
novalt12.0.0a0

6.7 Medium

AI Score

Confidence

Low

3.5 Low

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

49.6%