CVE-2015-7713 OpenStack Compute (Nova) allows remote attackers to bypass intended restriction
MediumCVSS 5.0
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi nova(PyPI) | < 2014.2.4 | 2014.2.4 |
| pypi nova(PyPI) | >= 2015.1.0, < 2015.1.2 | 2015.1.2 |
| pypi nova(PyPI) | = 15.1.5 | No fix listed |
| pypi nova(PyPI) | = 16.1.6 | No fix listed |
| pypi nova(PyPI) | = 16.1.7 | No fix listed |
| pypi nova(PyPI) | = 16.1.8 | No fix listed |
| pypi nova(PyPI) | = 17.0.10 | No fix listed |
| pypi nova(PyPI) | = 17.0.11 | No fix listed |
| pypi nova(PyPI) | = 17.0.12 | No fix listed |
| pypi nova(PyPI) | = 17.0.13 | No fix listed |
| pypi nova(PyPI) | = 17.0.7 | No fix listed |
| pypi nova(PyPI) | = 17.0.8 | No fix listed |
| pypi nova(PyPI) | = 17.0.9 | No fix listed |
| pypi nova(PyPI) | = 18.0.2 | No fix listed |
| pypi nova(PyPI) | = 18.0.3 | No fix listed |
| pypi nova(PyPI) | = 18.1.0 | No fix listed |
| pypi nova(PyPI) | = 18.2.0 | No fix listed |
| pypi nova(PyPI) | = 18.2.1 | No fix listed |
| pypi nova(PyPI) | = 18.2.2 | No fix listed |
| pypi nova(PyPI) | = 18.2.3 | No fix listed |
| pypi nova(PyPI) | = 18.3.0 | No fix listed |
| pypi nova(PyPI) | = 19.0.0 | No fix listed |
| pypi nova(PyPI) | = 19.0.0.0rc1 | No fix listed |
| pypi nova(PyPI) | = 19.0.0.0rc2 | No fix listed |
| pypi nova(PyPI) | = 19.0.1 | No fix listed |
Show 125 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi nova(PyPI) | = 19.0.2 | No fix listed |
| pypi nova(PyPI) | = 19.0.3 | No fix listed |
| pypi nova(PyPI) | = 19.1.0 | No fix listed |
| pypi nova(PyPI) | = 19.2.0 | No fix listed |
| pypi nova(PyPI) | = 19.3.0 | No fix listed |
| pypi nova(PyPI) | = 19.3.1 | No fix listed |
| pypi nova(PyPI) | = 19.3.2 | No fix listed |
| pypi nova(PyPI) | = 20.0.0 | No fix listed |
| pypi nova(PyPI) | = 20.0.0.0rc1 | No fix listed |
| pypi nova(PyPI) | = 20.0.0.0rc2 | No fix listed |
| pypi nova(PyPI) | = 20.0.1 | No fix listed |
| pypi nova(PyPI) | = 20.1.0 | No fix listed |
| pypi nova(PyPI) | = 20.1.1 | No fix listed |
| pypi nova(PyPI) | = 20.2.0 | No fix listed |
| pypi nova(PyPI) | = 20.3.0 | No fix listed |
| pypi nova(PyPI) | = 20.4.0 | No fix listed |
| pypi nova(PyPI) | = 20.4.1 | No fix listed |
| pypi nova(PyPI) | = 20.5.0 | No fix listed |
| pypi nova(PyPI) | = 20.6.0 | No fix listed |
| pypi nova(PyPI) | = 20.6.1 | No fix listed |
| pypi nova(PyPI) | = 21.0.0 | No fix listed |
| pypi nova(PyPI) | = 21.0.0.0rc1 | No fix listed |
| pypi nova(PyPI) | = 21.0.0.0rc2 | No fix listed |
| pypi nova(PyPI) | = 21.1.0 | No fix listed |
| pypi nova(PyPI) | = 21.1.1 | No fix listed |
| pypi nova(PyPI) | = 21.1.2 | No fix listed |
| pypi nova(PyPI) | = 21.2.0 | No fix listed |
| pypi nova(PyPI) | = 21.2.1 | No fix listed |
| pypi nova(PyPI) | = 21.2.2 | No fix listed |
| pypi nova(PyPI) | = 21.2.3 | No fix listed |
| pypi nova(PyPI) | = 21.2.4 | No fix listed |
| pypi nova(PyPI) | = 22.0.0 | No fix listed |
| pypi nova(PyPI) | = 22.0.0.0rc1 | No fix listed |
| pypi nova(PyPI) | = 22.0.1 | No fix listed |
| pypi nova(PyPI) | = 22.1.0 | No fix listed |
| pypi nova(PyPI) | = 22.2.0 | No fix listed |
| pypi nova(PyPI) | = 22.2.1 | No fix listed |
| pypi nova(PyPI) | = 22.2.2 | No fix listed |
| pypi nova(PyPI) | = 22.3.0 | No fix listed |
| pypi nova(PyPI) | = 22.4.0 | No fix listed |
| pypi nova(PyPI) | = 23.0.0 | No fix listed |
| pypi nova(PyPI) | = 23.0.0.0rc1 | No fix listed |
| pypi nova(PyPI) | = 23.0.0.0rc2 | No fix listed |
| pypi nova(PyPI) | = 23.0.1 | No fix listed |
| pypi nova(PyPI) | = 23.0.2 | No fix listed |
| pypi nova(PyPI) | = 23.1.0 | No fix listed |
| pypi nova(PyPI) | = 23.2.0 | No fix listed |
| pypi nova(PyPI) | = 23.2.1 | No fix listed |
| pypi nova(PyPI) | = 23.2.2 | No fix listed |
| pypi nova(PyPI) | = 24.0.0 | No fix listed |
| pypi nova(PyPI) | = 24.0.0.0rc1 | No fix listed |
| pypi nova(PyPI) | = 24.0.0.0rc2 | No fix listed |
| pypi nova(PyPI) | = 24.1.0 | No fix listed |
| pypi nova(PyPI) | = 24.1.1 | No fix listed |
| pypi nova(PyPI) | = 24.2.0 | No fix listed |
| pypi nova(PyPI) | = 24.2.1 | No fix listed |
| pypi nova(PyPI) | = 25.0.0 | No fix listed |
| pypi nova(PyPI) | = 25.0.0.0rc1 | No fix listed |
| pypi nova(PyPI) | = 25.0.1 | No fix listed |
| pypi nova(PyPI) | = 25.1.0 | No fix listed |
| pypi nova(PyPI) | = 25.1.1 | No fix listed |
| pypi nova(PyPI) | = 25.2.0 | No fix listed |
| pypi nova(PyPI) | = 25.2.1 | No fix listed |
| pypi nova(PyPI) | = 25.3.0 | No fix listed |
| pypi nova(PyPI) | = 26.0.0 | No fix listed |
| pypi nova(PyPI) | = 26.0.0.0rc1 | No fix listed |
| pypi nova(PyPI) | = 26.0.0.0rc2 | No fix listed |
| pypi nova(PyPI) | = 26.1.0 | No fix listed |
| pypi nova(PyPI) | = 26.1.1 | No fix listed |
| pypi nova(PyPI) | = 26.2.0 | No fix listed |
| pypi nova(PyPI) | = 26.2.1 | No fix listed |
| pypi nova(PyPI) | = 26.2.2 | No fix listed |
| pypi nova(PyPI) | = 26.3.0 | No fix listed |
| pypi nova(PyPI) | = 27.0.0 | No fix listed |
| pypi nova(PyPI) | = 27.0.0.0rc1 | No fix listed |
| pypi nova(PyPI) | = 27.1.0 | No fix listed |
| pypi nova(PyPI) | = 27.2.0 | No fix listed |
| pypi nova(PyPI) | = 27.3.0 | No fix listed |
| pypi nova(PyPI) | = 27.4.0 | No fix listed |
| pypi nova(PyPI) | = 27.5.0 | No fix listed |
| pypi nova(PyPI) | = 27.5.1 | No fix listed |
| pypi nova(PyPI) | = 28.0.0 | No fix listed |
| pypi nova(PyPI) | = 28.0.0.0rc1 | No fix listed |
| pypi nova(PyPI) | = 28.0.1 | No fix listed |
| pypi nova(PyPI) | = 28.1.0 | No fix listed |
| pypi nova(PyPI) | = 28.2.0 | No fix listed |
| pypi nova(PyPI) | = 28.3.0 | No fix listed |
| pypi nova(PyPI) | = 28.3.1 | No fix listed |
| pypi nova(PyPI) | = 29.0.0 | No fix listed |
| pypi nova(PyPI) | = 29.0.0.0rc1 | No fix listed |
| pypi nova(PyPI) | = 29.0.1 | No fix listed |
| pypi nova(PyPI) | = 29.0.2 | No fix listed |
| pypi nova(PyPI) | = 29.1.0 | No fix listed |
| pypi nova(PyPI) | = 29.2.0 | No fix listed |
| pypi nova(PyPI) | = 29.2.1 | No fix listed |
| pypi nova(PyPI) | = 29.2.2 | No fix listed |
| pypi nova(PyPI) | = 29.3.0 | No fix listed |
| pypi nova(PyPI) | = 29.4.0 | No fix listed |
| pypi nova(PyPI) | = 30.0.0 | No fix listed |
| pypi nova(PyPI) | = 30.0.0.0rc1 | No fix listed |
| pypi nova(PyPI) | = 30.1.0 | No fix listed |
| pypi nova(PyPI) | = 30.2.0 | No fix listed |
| pypi nova(PyPI) | = 30.2.1 | No fix listed |
| pypi nova(PyPI) | = 30.3.0 | No fix listed |
| pypi nova(PyPI) | = 31.0.0 | No fix listed |
| pypi nova(PyPI) | = 31.0.0.0rc1 | No fix listed |
| pypi nova(PyPI) | = 31.0.1 | No fix listed |
| pypi nova(PyPI) | = 31.1.0 | No fix listed |
| pypi nova(PyPI) | = 31.2.0 | No fix listed |
| pypi nova(PyPI) | = 31.3.0 | No fix listed |
| pypi nova(PyPI) | = 31.3.1 | No fix listed |
| pypi nova(PyPI) | = 32.0.0 | No fix listed |
| pypi nova(PyPI) | = 32.0.0.0rc1 | No fix listed |
| pypi nova(PyPI) | = 32.1.0 | No fix listed |
| pypi nova(PyPI) | = 32.2.0 | No fix listed |
| pypi nova(PyPI) | = 32.2.1 | No fix listed |
| pypi nova(PyPI) | = 33.0.0 | No fix listed |
| pypi nova(PyPI) | = 33.0.0.0rc1 | No fix listed |
| pypi nova(PyPI) | = 33.0.1 | No fix listed |
| pypi nova(PyPI) | = 33.0.2 | No fix listed |
| debian/nova(Debian:12) | < 1:12.0.0-2 | 1:12.0.0-2 |
| debian/nova(Debian:13) | < 1:12.0.0-2 | 1:12.0.0-2 |
| debian/nova(Debian:14) | < 1:12.0.0-2 | 1:12.0.0-2 |
| OpenStack Nova | >= 2014.2, < 2014.2.4 | 2014.2.4 |
| OpenStack Nova | >= 2015.1.0, < 2015.1.2 | 2015.1.2 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- RHSA-2015:2673 third-party-advisory vendor-advisory
- bugs.launchpad.net third-party-advisory
- bugs.launchpad.net third-party-advisory
- security.openstack.org vendor-advisory
- RHSA-2015:2684 third-party-advisory vendor-advisory
- access.redhat.com
- access.redhat.com
- access.redhat.com
- access.redhat.com
- bugzilla.redhat.com
- web.archive.org
- 76960 third-party-advisory vdb-entry
- github.com vendor-advisory
- opendev.org product
- pypi.org product
- Debian Security Tracker CVE-2015-7713 vendor-advisory