Description
OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the migration process when the instance is deleted, which allows remote authenticated users to cause a denial of service (disk, network, and other resource consumption) by resizing and then deleting an instance.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nova | 1:12.0.0-2 | — |
| Debian 13 | nova | 1:12.0.0-2 | — |
| Debian 12 | nova | 1:12.0.0-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | nova | 1:2014.1.5-0ubuntu1.7 | USN-3449-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 7 | python-nova +15 | 2015.1.0-18.el7ost | RHSA-2015:1898, RHSA-2015:1723 |
| Red Hat OpenStack 6 | python-nova +14 | 2014.2.3-31.el7ost | RHSA-2015:1898 |
| Red Hat OpenStack 5 | python-nova +14 | 2014.1.5-3.el6ost | RHSA-2015:1898 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 5 | openstack-nova +1 | 2014.2.4~a0~dev80-20.1 | SUSE-SU-2015:2219-1 |
| SUSE Cloud Compute Node for SUSE Linux Enterprise 12 | openstack-neutron | 2014.2.4~a0~dev103-10.3 | SUSE-SU-2015:2220-1 |
| SUSE Cloud Compute Node for SUSE Linux Enterprise 12 | openstack-nova | 2014.2.4~a0~dev80-14.1 | SUSE-SU-2015:2220-1 |
| SUSE Cloud Compute Node for SUSE Linux Enterprise 12 | python-python-memcached | 1.54-2.1 | SUSE-SU-2015:2220-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | nova | < 112.0.0.0b3 | 112.0.0.0b3 | GHSA-3vx7-xff6-h2vx |
| PyPI | nova | < 12.0.0.0b3 | 12.0.0.0b3 | PYSEC-2026-861 |
Advisories 5
- RHSA-2015:1898 Red Hat Security Advisory: openstack-nova security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2015:1723 Red Hat Security Advisory: openstack-nova security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- USN-3449-1 nova vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2015:2219-1 Security update for openstack-nova SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:2220-1 Security update for openstack-nova and openstack-neutron SUSE / openSUSE Security Updates · Feb 4, 2026