PT-2012-3807 · Openstack · Openstack Compute

Dan Prince · Publicado 2012-06-07 · Atualizado 2022-05-17 · CVE-2012-2101

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Openstack Compute (Nova) versions 2011.3 through 2012.1

Description The issue allows remote authenticated users with certain permissions to cause a denial of service by consuming CPU and hard drive resources via a network request that triggers a large number of iptables rules, due to the lack of limitation on the number of security group rules.

Recommendations For versions 2011.3 through 2012.1, consider implementing a limit on the number of security group rules to prevent excessive resource consumption. As a temporary workaround, restrict access to users with permissions that could trigger a large number of iptables rules.

Correção

DoS

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2012-2101

GHSA-HQ3F-9GF7-73R8

PYSEC-2012-36

Produtos afetados

Openstack Compute

Referências · 21

• https://github.com/openstack/nova/commit/1f644d210557b1254f7c7b39424b09a45329ade7 · Nota
• https://github.com/openstack/nova/commit/a67db4586f70ed881d65e80035b2a25be195ce64 · Nota
• https://github.com/openstack/nova/commit/8c8735a73afb16d5856f0aa6088e9ae406c52beb · Nota
• https://github.com/openstack/nova · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2012-36.yaml · Nota
• https://bugs.launchpad.net/nova/+bug/969545 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079434.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2012-2101 · Aviso do Fabricante
• https://lists.launchpad.net/openstack/msg10268.html · Nota
• http://secunia.com/advisories/49034 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2012-36 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-2101 · Nota de Segurança
• http://secunia.com/advisories/49048 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2012-2101 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-hq3f-9gf7-73r8 · Aviso do Fabricante