CVE-2011-4596 OpenStack Nova Multiple directory traversal vulnerabilities
MediumCVSS 6.0
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary files via a crafted (1) tarball or (2) manifest.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi nova(PyPI) | < 12.0.0a0 | 12.0.0a0 |
| debian/nova(Debian:12) | < 2012.1~e1-4 | 2012.1~e1-4 |
| debian/nova(Debian:13) | < 2012.1~e1-4 | 2012.1~e1-4 |
| debian/nova(Debian:14) | < 2012.1~e1-4 | 2012.1~e1-4 |
| OpenStack Nova | >= 2011.3, < 2011.3.1 | 2011.3.1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch third-party-advisory
- github.com patch third-party-advisory
- bugs.launchpad.net third-party-advisory
- bugs.launchpad.net third-party-advisory
- github.com product
- [openstack] 20111213 [OSSA 2011-001] Path traversal issues registering malicious images using EC2 API (CVE-2011-4596) mailing-list third-party-advisory
- pypi.org product
- github.com vendor-advisory
- Debian Security Tracker CVE-2011-4596 vendor-advisory