CVE-2014-0167
Fixed in a distro release EPSS 2%
The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.
Products: openstack compute, openstack icehouse
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | nova | 2013.2.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | nova | 2013.2.3-1 |
| Debian 13 | nova | 2013.2.3-1 |
| Debian 14 | nova | 2013.2.3-1 |
| Red Hat openstack 4 | openstack-nova | 0:2013.2.3-12.el6ost |
| Red Hat openstack 4 | openstack-nova-api | 0:2013.2.3-12.el6ost |
| Red Hat openstack 4 | openstack-nova-cells | 0:2013.2.3-12.el6ost |
| Red Hat openstack 4 | openstack-nova-cert | 0:2013.2.3-12.el6ost |
| Red Hat openstack 4 | openstack-nova-common | 0:2013.2.3-12.el6ost |
| Red Hat openstack 4 | openstack-nova-compute | 0:2013.2.3-12.el6ost |
| Red Hat openstack 4 | openstack-nova-conductor | 0:2013.2.3-12.el6ost |
| Red Hat openstack 4 | openstack-nova-console | 0:2013.2.3-12.el6ost |
| Red Hat openstack 4 | openstack-nova-doc | 0:2013.2.3-12.el6ost |
| Red Hat openstack 4 | openstack-nova-network | 0:2013.2.3-12.el6ost |
| Red Hat openstack 4 | openstack-nova-novncproxy | 0:2013.2.3-12.el6ost |
| Red Hat openstack 4 | openstack-nova-objectstore | 0:2013.2.3-12.el6ost |
| Red Hat openstack 4 | openstack-nova-scheduler | 0:2013.2.3-12.el6ost |
| Red Hat openstack 4 | python-nova | 0:2013.2.3-12.el6ost |
| Ubuntu 14.04 LTS | nova | 1:2014.1-0ubuntu1.2 |