Description
OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes, which allows remote authenticated users to cause a denial of service (disk consumption) by deleting instances while in the resize state.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nova | 1:12.0.0-2 | — |
| Debian 13 | nova | 1:12.0.0-2 | — |
| Debian 12 | nova | 1:12.0.0-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | nova | 1:2014.1.5-0ubuntu1.7 | USN-3449-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 7 | python-nova +15 | 2015.1.1-3.el7ost | RHSA-2015:1898 |
| Red Hat OpenStack 6 | python-nova +14 | 2014.2.3-31.el7ost | RHSA-2015:1898 |
| Red Hat OpenStack 5 | python-nova +14 | 2014.1.5-3.el6ost | RHSA-2015:1898 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud 5 | openstack-nova +1 | 2014.2.4~a0~dev80-20.1 | SUSE-SU-2015:2219-1 |
| SUSE Cloud Compute Node for SUSE Linux Enterprise 12 | openstack-neutron | 2014.2.4~a0~dev103-10.3 | SUSE-SU-2015:2220-1 |
| SUSE Cloud Compute Node for SUSE Linux Enterprise 12 | openstack-nova | 2014.2.4~a0~dev80-14.1 | SUSE-SU-2015:2220-1 |
| SUSE Cloud Compute Node for SUSE Linux Enterprise 12 | python-python-memcached | 1.54-2.1 | SUSE-SU-2015:2220-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | nova | < 2014.2.4 | 2014.2.4 | GHSA-mfmj-gwg3-vhw7 |
| PyPI | nova | >= 2015.1.0, < 2015.1.2 | 2015.1.2 | GHSA-mfmj-gwg3-vhw7 |
| PyPI | nova | < 2014.2.4 · >= 2015.1.0, < 2015.1.2 | 2014.2.4, 2015.1.2 | PYSEC-2026-877 |
Advisories 4
- RHSA-2015:1898 Red Hat Security Advisory: openstack-nova security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- USN-3449-1 nova vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2015:2219-1 Security update for openstack-nova SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:2220-1 Security update for openstack-nova and openstack-neutron SUSE / openSUSE Security Updates · Feb 4, 2026