CVE-2014-0167 OpenStack Compute (Nova) allows remote authenticated users to gain privileges via API requests
MediumCVSS 6.0
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi nova(PyPI) | >= 2013.1.0, < 2013.2.4 | 2013.2.4 |
| debian/nova(Debian:12) | < 2013.2.3-1 | 2013.2.3-1 |
| debian/nova(Debian:13) | < 2013.2.3-1 | 2013.2.3-1 |
| debian/nova(Debian:14) | < 2013.2.3-1 | 2013.2.3-1 |
| OpenStack compute | = 2013.1 | No fix listed |
| OpenStack compute | = 2013.1.1 | No fix listed |
| OpenStack compute | = 2013.1.2 | No fix listed |
| OpenStack compute | = 2013.1.3 | No fix listed |
| OpenStack compute | = 2013.2 | No fix listed |
| OpenStack compute | = 2013.2.1 | No fix listed |
| OpenStack compute | = 2013.2.2 | No fix listed |
| OpenStack compute | = 2013.2.3 | No fix listed |
| OpenStack icehouse | All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- launchpad.net vendor-advisory
- opendev.org product
- [oss-security] 20140409 [OSSA 2014-011] RBAC policy not properly enforced in Nova EC2 API (CVE-2014-0167) mailing-list patch
- USN-2247-1 vendor-advisory
- pypi.org product
- github.com vendor-advisory
- Debian Security Tracker CVE-2014-0167 vendor-advisory
- bugs.debian.org issue-tracking