CVE-2016-7498 OpenStack Compute (nova) 13.0.0 does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances whi...
MediumCVSS 6.5
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Compute (nova) 13.0.0 does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state. NOTE: this vulnerability exists because of a CVE-2015-3280 regression.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/nova(Debian:12) | < 2:13.1.0-1 | 2:13.1.0-1 |
| debian/nova(Debian:13) | < 2:13.1.0-1 | 2:13.1.0-1 |
| debian/nova(Debian:14) | < 2:13.1.0-1 | 2:13.1.0-1 |
| OpenStack compute nova | = 13.0.0 | No fix listed |
References
- Debian Security Tracker CVE-2016-7498 vendor-advisory
- [oss-security] 20160921 Re: CVE request for vulnerability in OpenStack Nova mailing-list third-party-advisory
- [oss-security] 20160923 [OSSA 2016-011] Nova may fail to delete images in resize state regression (CVE-2016-7498) mailing-list third-party-advisory
- 93068 third-party-advisory vdb-entry
- security.openstack.org patch vendor-advisory