Description
The Nova scheduler in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when DifferentHostFilter or SameHostFilter is enabled, allows remote authenticated users to cause a denial of service (excessive database lookup calls and server hang) via a request with many repeated IDs in the os:scheduler_hints section.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nova | 2012.1.1-5 | — |
| Debian 13 | nova | 2012.1.1-5 | — |
| Debian 12 | nova | 2012.1.1-5 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | nova | < 12.0.0a0 | 12.0.0a0 | GHSA-xxgm-qpj5-4886 |
References
- 54388 vdb-entry
- [openstack] 20120711 [OSSA 2012-009] Scheduler denial of service through scheduler_hints (CVE-2012-3371) mailing-list
- https://bugs.launchpad.net/nova/+bug/1017795
- [oss-security] 20120711 [OSSA 2012-009] Scheduler denial of service through scheduler_hints (CVE-2012-3371) mailing-list
- USN-1501-1 vendor-advisory
- https://github.com/openstack/nova/commit/034762e8060dcf0a11cb039b9d426b0d0bb1801d