CVE-2014-2573

The VMware driver in OpenStack Compute (Nova) 2013.2–2013.2.2 does not correctly place VMs into RESCUE, allowing remote authenticated users to bypass quota and trigger a denial of service by rescuing the VM and then deleting the image. Related advisories (GHSA/OSV) reiterate the vulnerability and...

CVE-2013-2030

CVE-2013-2030 affects OpenStack Nova (keystone/middleware/auth_token.py) in Folsom, Grizzly, and Havana. It uses an insecure temporary directory to store signing certificates, enabling local users to spoof servers by pre-creating the directory (e.g., /tmp/keystone-signing-nova on Fedora). Several...