CVE-2017-16239 OpenStack Nova Filter Scheduler Bypass
MediumCVSS 6.5
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Because of the regression described in Launchpad Bug #1732947, the preferred fix is a 14.x version after 14.0.10, a 15.x version after 15.0.8, or a 16.x version after 16.0.3.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi nova(PyPI) | >= 16.0.0, < 16.0.3 | 16.0.3 |
| pypi nova(PyPI) | >= 15.0.0, < 15.0.8 | 15.0.8 |
| pypi nova(PyPI) | >= 14.0.0, < 14.0.10 | 14.0.10 |
| debian/nova(Debian:12) | < 2:16.0.3-1 | 2:16.0.3-1 |
| debian/nova(Debian:13) | < 2:16.0.3-1 | 2:16.0.3-1 |
| debian/nova(Debian:14) | < 2:16.0.3-1 | 2:16.0.3-1 |
| OpenStack Nova | <= 14.0.9 | No fix listed |
| OpenStack Nova | = 15.0.0 | No fix listed |
| OpenStack Nova | = 15.0.1 | No fix listed |
| OpenStack Nova | = 15.0.2 | No fix listed |
| OpenStack Nova | = 15.0.3 | No fix listed |
| OpenStack Nova | = 15.0.4 | No fix listed |
| OpenStack Nova | = 15.0.5 | No fix listed |
| OpenStack Nova | = 15.0.6 | No fix listed |
| OpenStack Nova | = 15.0.7 | No fix listed |
| OpenStack Nova | = 16.0.0 | No fix listed |
| OpenStack Nova | = 16.0.1 | No fix listed |
| OpenStack Nova | = 16.0.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- github.com patch
- RHSA-2018:0241 vendor-advisory
- RHSA-2018:0314 vendor-advisory
- RHSA-2018:0369 vendor-advisory
- github.com product
- launchpad.net issue-tracking
- security.openstack.org vendor-advisory
- DSA-4056 vendor-advisory
- 101950 third-party-advisory vdb-entry
- pypi.org product
- github.com vendor-advisory
- Debian Security Tracker CVE-2017-16239 vendor-advisory
- bugs.debian.org issue-tracking