Skip to content
OpenAdvisories
Unscored RHSA-2014:1084 2 CVEs

Red Hat Security Advisory: openstack-nova security, bug fix, and enhancement update

Published Sep 15, 2024 · Updated Aug 1, 2026

Ecosystem: Red Hat

Fixed packages 14

ReleasePackageFixed in
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova 0:2013.2.3-12.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-api 0:2013.2.3-12.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-cells 0:2013.2.3-12.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-cert 0:2013.2.3-12.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-common 0:2013.2.3-12.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-compute 0:2013.2.3-12.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-conductor 0:2013.2.3-12.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-console 0:2013.2.3-12.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-doc 0:2013.2.3-12.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-network 0:2013.2.3-12.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-novncproxy 0:2013.2.3-12.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-objectstore 0:2013.2.3-12.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-nova-scheduler 0:2013.2.3-12.el6ost
Red Hat · OpenStack 4 openstack:4::el6 python-nova 0:2013.2.3-12.el6ost

Vulnerabilities 2

  • Medium —
    CVE-2014-0167

    OpenStack Compute (Nova) allows remote authenticated users to gain privileges via API requests

    The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py…

    nova nova Debian PyPI
  • Medium —
    CVE-2014-3517

    OpenStack Compute (Nova) Exposure of Sensitive Information to an Unauthorized Actor vulnerability

    api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying metadata requests through Neutron, makes it easier for remote attackers to guess instance ID signatures via a brute-force attack…

    nova nova nova Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux_OpenStack_Platform/4/html/Technical_Notes/index.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1082670
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1084868
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1085006
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1086814
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1086815
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1090068
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1104082
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1112499
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1114150
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1116432
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1084.json
  • report
    https://access.redhat.com/security/cve/CVE-2014-0167
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-0167
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-0167
  • report
    https://access.redhat.com/security/cve/CVE-2014-3517
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-3517
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-3517