OpenStack Compute (Nova) allows remote authenticated users to gain privileges via API requests

MEDIO 6.0CVE-2014-0167 · GHSA-p258-xmh3-72pv · PYSEC-2026-878 · Published 15/04/2014 · updated 17/06/2026

Package	Affected versions	Patched versions
nova PyPI	`≥ 2013.1.0, < 2013.2.4`	`2013.2.4`
compute openstack	`= 2013.1= 2013.1.1= 2013.1.2= 2013.1.3= 2013.2= 2013.2.1= 2013.2.2= 2013.2.3`	No fix yet

Description

The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2014-0167 · ADVISORY
access.redhat.com/errata/RHSA-2014:1084 · WEB
access.redhat.com/security/cve/CVE-2014-0167 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
launchpad.net/bugs/1290537 · WEB
opendev.org/openstack/nova · PACKAGE
openwall.com/lists/oss-security/2014/04/09/26 · WEB
ubuntu.com/usn/USN-2247-1 · WEB
pypi.org/project/nova · PACKAGE
GitHub Advisory GHSA-p258-xmh3-72pv · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free