Description
Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nova +1 | 2013.2.1-1 | — |
| Debian 13 | nova +1 | 2013.2.1-1 | — |
| Debian 12 | nova +1 | 2013.2.1-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 4 | python-neutron +17 | 2013.2.1-4.el6ost | RHSA-2014:0091 |
| Red Hat OpenStack 4 | python-nova +13 | 2013.2.2-2.el6ost | RHSA-2014:0231 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | nova | < 12.0.0a0 | 12.0.0a0 | GHSA-22w9-j288-8p9w |
Advisories 2
- RHSA-2014:0231 Red Hat Security Advisory: openstack-nova security and bug fix update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2014:0091 Red Hat Security Advisory: openstack-neutron security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 1, 2026
References
- 64250 vdb-entry
- https://review.openstack.org/#/c/61428/2/nova/api/metadata/handler.py
- RHSA-2014:0091 vendor-advisory
- RHSA-2014:0231 vendor-advisory
- [oss-security] 20131211 [OSSA 2013-033] Metadata queries from Neutron to Nova are not restricted by tenant (CVE-2013-6419) mailing-list
- https://review.openstack.org/#/c/61439/1/neutron/agent/metadata/agent.py
- https://bugs.launchpad.net/neutron/+bug/1235450