CVE-2012-2654
Fixed in a distro release EPSS 3%
The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.
Products: openstack compute, openstack diablo, openstack essex
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | nova | 12.0.0a0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | nova | 2012.1-6 |
| Debian 13 | nova | 2012.1-6 |
| Debian 14 | nova | 2012.1-6 |