OpenStack Compute (nova) allows remote authenticated users to cause a denial of service

MEDIUM 6.8CVE-2015-3280 · GHSA-mfmj-gwg3-vhw7 · PYSEC-2026-877 · Published 26/10/2015 · updated 17/06/2026

Package	Affected versions	Patched versions
nova PyPI	`≥ 2015.1.0, < 2015.1.2< 2014.2.4`	`2015.1.22014.2.4`
nova openstack	`≥ 2014.2, < 2014.2.4≥ 2015.1.0, < 2015.1.2`	`2014.2.42015.1.2`

Description

OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2015-3280 · ADVISORY
access.redhat.com/errata/RHSA-2015:1898 · WEB
access.redhat.com/security/cve/CVE-2015-3280 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
launchpad.net/bugs/1392527 · WEB
opendev.org/openstack/nova · PACKAGE
security.openstack.org/ossa/OSSA-2015-017.html · WEB
web.archive.org/web/20200228023247/http://www.securityfocus.com/bid/76553 · WEB
rhn.redhat.com/errata/RHSA-2015-1898.html · WEB
oracle.com/technetwork/topics/security/bulletinjan2016-2867206.html · WEB
securityfocus.com/bid/76553 · WEB
pypi.org/project/nova · PACKAGE
GitHub Advisory GHSA-mfmj-gwg3-vhw7 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free