CVE-2015-2687 OpenStack Compute (Nova) Improper Access Control
MediumCVSS 4.7
EPSS 0.34%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normally not have permissions for.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi nova(PyPI) | < 15.0.0.0b1 | 15.0.0.0b1 |
| debian/nova(Debian:12) | < 2014.1-1 | 2014.1-1 |
| debian/nova(Debian:13) | < 2014.1-1 | 2014.1-1 |
| debian/nova(Debian:14) | < 2014.1-1 | 2014.1-1 |
| OpenStack compute | = 2013.2 | No fix listed |
| OpenStack compute | = 2013.2.1 | No fix listed |
| OpenStack compute | = 2013.2.2 | No fix listed |
| OpenStack compute | = 2013.2.3 | No fix listed |
| OpenStack compute | = 2013.2.4 | No fix listed |
| OpenStack compute | = 2014.1 | No fix listed |
| OpenStack compute | = 2014.1.1 | No fix listed |
| OpenStack compute | = 2014.1.2 | No fix listed |
| OpenStack compute | = 2014.1.3 | No fix listed |
| OpenStack compute | = 2014.1.4 | No fix listed |
| OpenStack compute | = 2014.1.5 | No fix listed |
| OpenStack compute | = 2014.2 | No fix listed |
| OpenStack compute | = 2014.2.1 | No fix listed |
| OpenStack compute | = 2014.2.2 | No fix listed |
| OpenStack compute | = 2014.2.3 | No fix listed |
| OpenStack compute | = 2014.2.4 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- bugs.launchpad.net issue-tracking third-party-advisory vdb-entry vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory vdb-entry vendor-advisory
- github.com product
- github.com
- review.openstack.org third-party-advisory
- [oss-security] 20150324 Re: CVE request for OpenStack Compute (nova) mailing-list third-party-advisory
- [oss-security] 20150325 Re: CVE request for OpenStack Compute (nova) mailing-list third-party-advisory
- 77505 third-party-advisory vdb-entry vendor-advisory
- Debian Security Tracker CVE-2015-2687 vendor-advisory
- github.com