Skip to content
OpenAdvisories
Unscored USN-2407-1 2 CVEs

nova vulnerabilities

Published Nov 11, 2014 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Garth Mollett discovered that OpenStack Nova did not properly clean up an
instance when using rescue mode with the VMWare driver. A remove
authenticated user could exploit this to bypass intended quota limits. By
default, Ubuntu does not use the VMWare driver. (CVE-2014-3608)

Amrith Kumar discovered that OpenStack Nova did not properly sanitize log
message contents. Under certain circumstances, a local attacker with read
access to Nova log files could obtain access to sensitive information.
(CVE-2014-7230)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS nova 1:2014.1.3-0ubuntu1.1

Vulnerabilities 2

  • Medium —
    CVE-2014-3608

    OpenStack Compute (Nova)'s VMWare driver vulnerable to denial of service

    The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by putting the VM into the rescue state, suspending it, which puts into an ERROR sta…

    nova nova nova Debian Ubuntu PyPI
  • Unscored —
    CVE-2014-7230

    The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 befor…

    nova nova cinder cinder Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2014-3608
  • report
    https://ubuntu.com/security/CVE-2014-7230