OpenStack Nova Scheduler denial of service through scheduler_hints

BASSO 3.5CVE-2012-3371 · GHSA-xxgm-qpj5-4886 · PYSEC-2012-40 · Published 17/07/2012 · updated 16/06/2026

Package	Affected versions	Patched versions
nova PyPI	`< 12.0.0a0all versions`	`12.0.0a0`
compute openstack	`= 2012.2`	No fix yet
essex openstack	`= 2012.1`	No fix yet
folsom openstack	`= 2012.2`	No fix yet

Description

The Nova scheduler in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when DifferentHostFilter or SameHostFilter is enabled, allows remote authenticated users to cause a denial of service (excessive database lookup calls and server hang) via a request with many repeated IDs in the os:scheduler_hints section.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2012-3371 · ADVISORY
openstack/nova commit 034762e · WEB
bugs.launchpad.net/nova/+bug/1017795 · WEB
openstack/nova · PACKAGE
pypa/advisory-database · WEB
lists.launchpad.net/openstack/msg14452.html · WEB
openwall.com/lists/oss-security/2012/07/11/13 · WEB
ubuntu.com/usn/USN-1501-1 · WEB
securityfocus.com/bid/54388
GitHub Advisory GHSA-xxgm-qpj5-4886 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free