George Shuklin

**Name of the Vulnerable Software and Affected Versions** OpenStack Nova versions 14.0.0 through 14.0.9 OpenStack Nova versions 15.0.0 through 15.0.7 OpenStack Nova versions 16.0.0 through 16.0.2 **Description** The issue allows an authenticated user to bypass imposed filters, such as the ImagePropertiesFilter or the IsolatedHostsFilter, in the Nova Filter Scheduler by rebuilding an instance. All setups using Nova Filter Scheduler are affected. **Recommendations** For OpenStack Nova versions 14.0.0 through 14.0.9, update to a version after 14.0.10. For OpenStack Nova versions 15.0.0 through 15.0.7, update to a version after 15.0.8. For OpenStack Nova versions 16.0.0 through 16.0.2, update to a version after 16.0.3.

**Name of the Vulnerable Software and Affected Versions** OpenStack Compute (nova) versions before 2014.2.4 (juno) OpenStack Compute (nova) versions 2015.1.x before 2015.1.2 (kilo) **Description** The issue allows remote authenticated users to cause a denial of service, specifically disk consumption, by deleting instances while they are in the resize state. This occurs because OpenStack Compute (nova) does not properly delete instances from compute nodes. **Recommendations** For versions before 2014.2.4 (juno), update to version 2014.2.4 or later to resolve the issue. For versions 2015.1.x before 2015.1.2 (kilo), update to version 2015.1.2 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** OpenStack Compute (nova) versions 2015.1 through 2015.1.1 OpenStack Compute (nova) version 2014.2.3 and earlier **Description** The issue allows remote authenticated users to cause a denial of service by consuming disk, network, and other resources. This is achieved by resizing and then deleting an instance, which does not stop the migration process. An authenticated user could bypass user quota and deplete all available disk space by repeatedly re-sizing and deleting an instance. **Recommendations** For OpenStack Compute (nova) versions 2015.1 through 2015.1.1, update to a version that stops the migration process when an instance is deleted to prevent denial of service. For OpenStack Compute (nova) version 2014.2.3 and earlier, update to a version that stops the migration process when an instance is deleted to prevent denial of service. As a temporary workaround, consider restricting the ability to resize and delete instances to minimize the risk of exploitation.