OpenStack Nova VMWare driver leaks rescued images

BASSO 2.3CVE-2014-2573 · GHSA-jv34-xvjq-ppch · PYSEC-2014-113 · Published 25/03/2014 · updated 17/06/2026

Package	Affected versions	Patched versions
nova PyPI	`< 12.0.0a0`	`12.0.0a0`
compute openstack	`= 2013.2= 2013.2.1= 2013.2.2`	No fix yet

Description

The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2014-2573 · ADVISORY
openstack/nova commit b3cc3f6 · WEB
openstack/nova commit efb6653 · WEB
bugs.launchpad.net/nova/+bug/1269418 · WEB
openstack/nova · PACKAGE
pypa/advisory-database · WEB
openwall.com/lists/oss-security/2014/03/21/1 · WEB
openwall.com/lists/oss-security/2014/03/21/2 · WEB
secunia.com/advisories/57498 · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free