CVE-2014-0167: OpenStack Compute (Nova) allows remote… – CVSS 6.0 · Watchpost

← All vulnerabilities

OpenStack Compute (Nova) allows remote authenticated users to gain privileges via API requests

中危 6.0CVE-2014-0167 · GHSA-p258-xmh3-72pv · PYSEC-2026-878 · Published 15/04/2014 · updated 17/06/2026

要点

CVE-2014-0167 是影响 nova, compute (openstack) 的中危 (CVSS 6.0)漏洞。
未来 30 天内被利用的概率（EPSS）：1.7%，高于 76.6% 的漏洞。
修复：升级到 2013.2.4 或更高版本。

Package	Affected versions	Patched versions
nova PyPI	`≥ 2013.1.0, < 2013.2.4`	`2013.2.4`
compute openstack	`= 2013.1= 2013.1.1= 2013.1.2= 2013.1.3= 2013.2= 2013.2.1= 2013.2.2= 2013.2.3`	No fix yet

Description

The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.

NVD description

The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.

References

nvd.nist.gov/vuln/detail/CVE-2014-0167 · ADVISORY
access.redhat.com/errata/RHSA-2014:1084 · WEB
access.redhat.com/security/cve/CVE-2014-0167 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
launchpad.net/bugs/1290537 · WEB
opendev.org/openstack/nova · PACKAGE
openwall.com/lists/oss-security/2014/04/09/26 · WEB
ubuntu.com/usn/USN-2247-1 · WEB
pypi.org/project/nova · PACKAGE
GitHub Advisory GHSA-p258-xmh3-72pv · ADVISORY

nova 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free