PT-2012-6313 · Openstack · Openstack Compute

Publicado 2012-06-21 · Atualizado 2012-06-21

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions 2011.3 through 2012.2

Description The issue allows remote attackers to bypass intended access restrictions due to improper protocol checking when security groups are created and the network protocol is not specified entirely in lowercase.

Recommendations For OpenStack Compute (Nova) versions 2011.3 through 2012.2, consider updating the API to properly handle protocol specifications. As a temporary workaround, ensure that all network protocols are specified entirely in lowercase when creating security groups.

Identificadores relacionados

PYSEC-2012-37

Produtos afetados

Openstack Compute

Referências · 10

• https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09beac2978 · Nota
• https://github.com/openstack/nova/commit/ff06c7c885dc94ed7c828e8cdbb8b5d850a7e654 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76110 · Nota
• http://secunia.com/advisories/49439 · Nota
• https://bugs.launchpad.net/nova/+bug/985184 · Nota
• http://secunia.com/advisories/46808 · Nota
• https://review.openstack.org/#/c/8239 · Nota
• http://ubuntu.com/usn/USN-1466-1 · Nota
• https://osv.dev/vulnerability/PYSEC-2012-37 · Aviso do Fabricante
• https://lists.launchpad.net/openstack/msg12883.html · Nota