Skip to content
OpenAdvisories
High RHSA-2014:0231 4 CVEs

Red Hat Security Advisory: openstack-nova security and bug fix update

Published Sep 15, 2024 · Updated Aug 8, 2026

Ecosystem: Red Hat

Fixed packages 14

ReleasePackageFixed in
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova 0:2013.2.2-2.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-api 0:2013.2.2-2.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-cells 0:2013.2.2-2.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-cert 0:2013.2.2-2.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-common 0:2013.2.2-2.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-compute 0:2013.2.2-2.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-conductor 0:2013.2.2-2.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-console 0:2013.2.2-2.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-doc 0:2013.2.2-2.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-network 0:2013.2.2-2.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-novncproxy 0:2013.2.2-2.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-objectstore 0:2013.2.2-2.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-scheduler 0:2013.2.2-2.el6ost
Red Hat · OpenStack 4 openstack:4::el6 python-nova 0:2013.2.2-2.el6ost

Vulnerabilities 4

  • High 7.5
    CVE-2013-7130

    OpenStack Nova Live migration can leak root disk into ephemeral storage

    The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obt…

    nova nova Debian PyPI
  • Medium —
    CVE-2013-6419

    OpenStack Nova Router metadata queries are not restricted by tenant

    Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port,…

    nova nova neutron Debian PyPI
  • Medium —
    CVE-2013-6437

    OpenStack Nova DoS through ephemeral disk backing files

    The libvirt driver in OpenStack Compute (Nova) before 2013.2.2 and icehouse before icehouse-2 allows remote authenticated users to cause a denial of service (disk consumption) by creating and deleting instances with unique os_type settings, which triggers the…

    nova nova Debian PyPI
  • Low —
    CVE-2013-7048

    OpenStack Nova live snapshots use an insecure local directory

    OpenStack Compute (Nova) Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary directory used to store live snapshots, which allows local users to read and modify live snapshots.

    nova nova Debian PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1020979
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1039148
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1039554
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1040786
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1043106
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1047849
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1047863
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1055400
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1060771
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1062377
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1065317
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0231.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-6419
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-6419
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-6419
  • report
    https://access.redhat.com/security/cve/CVE-2013-6437
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-6437
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-6437
  • report
    https://access.redhat.com/security/cve/CVE-2013-7048
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-7048
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-7048
  • report
    https://access.redhat.com/security/cve/CVE-2013-7130
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-7130
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-7130