Description
The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nova | 2013.2.3-1 | — |
| Debian 13 | nova | 2013.2.3-1 | — |
| Debian 12 | nova | 2013.2.3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | nova | 1:2014.1-0ubuntu1.2 | USN-2247-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 4 | python-nova +13 | 2013.2.3-12.el6ost | RHSA-2014:1084 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | nova | >= 2013.1.0, < 2013.2.4 | 2013.2.4 | GHSA-p258-xmh3-72pv |
Advisories 2
- RHSA-2014:1084 Red Hat Security Advisory: openstack-nova security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- USN-2247-1 nova vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026