Skip to content
OpenAdvisories
High RHSA-2014:0366 3 CVEs

Red Hat Security Advisory: openstack-nova security and bug fix update

Published Sep 15, 2024 · Updated Aug 8, 2026

Ecosystem: Red Hat

Fixed packages 13

ReleasePackageFixed in
Red Hat · OpenStack 3 openstack:3::el6 openstack-nova 0:2013.1.5-2.el6ost
Red Hat · OpenStack 3 openstack:3::el6 openstack-nova-api 0:2013.1.5-2.el6ost
Red Hat · OpenStack 3 openstack:3::el6 openstack-nova-cells 0:2013.1.5-2.el6ost
Red Hat · OpenStack 3 openstack:3::el6 openstack-nova-cert 0:2013.1.5-2.el6ost
Red Hat · OpenStack 3 openstack:3::el6 openstack-nova-common 0:2013.1.5-2.el6ost
Red Hat · OpenStack 3 openstack:3::el6 openstack-nova-compute 0:2013.1.5-2.el6ost
Red Hat · OpenStack 3 openstack:3::el6 openstack-nova-conductor 0:2013.1.5-2.el6ost
Red Hat · OpenStack 3 openstack:3::el6 openstack-nova-console 0:2013.1.5-2.el6ost
Red Hat · OpenStack 3 openstack:3::el6 openstack-nova-doc 0:2013.1.5-2.el6ost
Red Hat · OpenStack 3 openstack:3::el6 openstack-nova-network 0:2013.1.5-2.el6ost
Red Hat · OpenStack 3 openstack:3::el6 openstack-nova-objectstore 0:2013.1.5-2.el6ost
Red Hat · OpenStack 3 openstack:3::el6 openstack-nova-scheduler 0:2013.1.5-2.el6ost
Red Hat · OpenStack 3 openstack:3::el6 python-nova 0:2013.1.5-2.el6ost

Vulnerabilities 3

  • High 7.5
    CVE-2013-7130

    OpenStack Nova Live migration can leak root disk into ephemeral storage

    The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obt…

    nova nova Debian PyPI
  • Medium —
    CVE-2013-4497

    OpenStack Compute Nova Improper Access Control

    The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions.

    nova nova Debian PyPI
  • Low —
    CVE-2013-7048

    OpenStack Nova live snapshots use an insecure local directory

    OpenStack Compute (Nova) Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary directory used to store live snapshots, which allows local users to read and modify live snapshots.

    nova nova Debian PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1026171
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1038239
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1040786
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1055400
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0366.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-4497
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4497
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4497
  • article
    https://launchpad.net/bugs/1073306
  • article
    https://launchpad.net/bugs/1202266
  • report
    https://access.redhat.com/security/cve/CVE-2013-7048
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-7048
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-7048
  • report
    https://access.redhat.com/security/cve/CVE-2013-7130
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-7130
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-7130