CVE-2014-8750

MEDIUM 6.5CVE-2014-8750 · Published 15/10/2014 · updated 17/06/2026

In short

CVE-2014-8750 is a MEDIUM (CVSS 6.5) vulnerability affecting nova (openstack).
Chance of exploitation in the next 30 days (EPSS): 2.0%, higher than 81.0% of all vulnerabilities.
Fix: update to 2014.1.4 or later.

Package	Affected versions	Patched versions
nova openstack	`= 2014.2≥ 2014.1, < 2014.1.4`	`2014.1.4`

Description

Race condition in the VMware driver in OpenStack Compute (Nova) before 2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated users to access unintended consoles by spawning an instance that triggers the same VNC port to be allocated to two different instances.

References

lists.openstack.org/pipermail/openstack-announce/2014-October/000293.html · Vendor Advisory
rhn.redhat.com/errata/RHSA-2014-1689.html · Third Party Advisory
rhn.redhat.com/errata/RHSA-2014-1781.html · Third Party Advisory
rhn.redhat.com/errata/RHSA-2014-1782.html · Third Party Advisory
secunia.com/advisories/60227 · Third Party Advisory
openwall.com/lists/oss-security/2014/10/14/9 · Mailing List
securityfocus.com/bid/70182 · Third Party Advisory
bugs.launchpad.net/nova/+bug/1357372 · Third Party Advisory

More vulnerabilities in nova

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

nova

openstack

= 2014.2≥ 2014.1, < 2014.1.4

2014.1.4

More vulnerabilities in nova

See all →