Skip to content
OpenAdvisories
High USN-3449-1 7 CVEs

nova vulnerabilities

Published Oct 11, 2017 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

George Shuklin discovered that OpenStack Nova incorrectly handled the
migration process. A remote authenticated user could use this issue to
consume resources, resulting in a denial of service. (CVE-2015-3241)

George Shuklin and Tushar Patil discovered that OpenStack Nova incorrectly
handled deleting instances. A remote authenticated user could use this
issue to consume disk resources, resulting in a denial of service.
(CVE-2015-3280)

It was discovered that OpenStack Nova incorrectly limited qemu-img calls. A
remote authenticated user could use this issue to consume resources,
resulting in a denial of service. (CVE-2015-5162)

Matthew Booth discovered that OpenStack Nova incorrectly handled snapshots.
A remote authenticated user could use this issue to read arbitrary files.
(CVE-2015-7548)

Sreekumar S. and Suntao discovered that OpenStack Nova incorrectly applied
security group changes. A remote attacker could possibly use this issue to
bypass intended restriction changes by leveraging an instance that was
running when the change was made. (CVE-2015-7713)

Matt Riedemann discovered that OpenStack Nova incorrectly handled logging.
A local attacker could possibly use this issue to obtain sensitive
information from log files. (CVE-2015-8749)

Matthew Booth discovered that OpenStack Nova incorrectly handled certain
qcow2 headers. A remote authenticated user could possibly use this issue to
read arbitrary files. (CVE-2016-2140)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS nova 1:2014.1.5-0ubuntu1.7

Vulnerabilities 7

  • High 7.5
    CVE-2015-5162

    OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption

    The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does not properly limit qemu-img calls, which might allow attackers to cause a denial of service (memory and disk consumptio…

    nova nova glance nova Debian Ubuntu PyPI
  • Medium 5.9
    CVE-2015-8749

    OpenStack Nova Potential Xen connection password leak via StorageError

    The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to o…

    nova nova nova Debian Ubuntu PyPI
  • Medium 5.3
    CVE-2016-2140

    OpenStack Nova host data access through resize/migration

    The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and use_cow_images is set to false, allows remote authenticated users to read arbitrary files via a crafted qcow2 header in an eph…

    nova nova nova Debian Ubuntu PyPI
  • Medium —
    CVE-2015-3241

    OpenStack Nova instance migration process does not stop when instance is deleted

    OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the migration process when the instance is deleted, which allows remote authenticated users to cause a denial of service (disk, network, and other resource consumption) by r…

    nova nova nova Debian Ubuntu PyPI
  • Medium —
    CVE-2015-3280

    OpenStack Compute (nova) allows remote authenticated users to cause a denial of service

    OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in t…

    nova nova nova Debian Ubuntu PyPI
  • Unscored —
    CVE-2015-7548

    OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty), when using libvirt to spawn instanc…

    nova nova Debian Ubuntu
  • Medium —
    CVE-2015-7713

    OpenStack Compute (Nova) allows remote attackers to bypass intended restriction

    OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made.

    nova nova nova Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2015-3241
  • report
    https://ubuntu.com/security/CVE-2015-3280
  • report
    https://ubuntu.com/security/CVE-2015-5162
  • report
    https://ubuntu.com/security/CVE-2015-7548
  • report
    https://ubuntu.com/security/CVE-2015-7713
  • report
    https://ubuntu.com/security/CVE-2015-8749
  • report
    https://ubuntu.com/security/CVE-2016-2140