PT-2014-3492 · Red Hat+2 · Libvirt+2

Stanislaw Pitucha · Publicado 2014-05-08 · Atualizado 2022-05-17 · CVE-2014-0134

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions 2013.2 through 2013.2.2 OpenStack Compute (Nova) versions prior to 2014.1 in the Icehouse release

Description The issue allows remote authenticated users to read certain compute host files by overwriting an instance disk with a crafted image when using libvirt to spawn images and use cow images is set to false.

Recommendations For OpenStack Compute (Nova) versions 2013.2 through 2013.2.2, update to version 2013.2.3 or later. For OpenStack Compute (Nova) versions prior to 2014.1 in the Icehouse release, update to version 2014.1 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-0134

GHSA-W429-XC55-HC48

PYSEC-2014-112

RHSA-2014:0578

USN-2247-1

Produtos afetados

Openstack Compute

Ubuntu

Libvirt

Referências · 23

• https://github.com/openstack/nova · Nota
• https://github.com/openstack/nova/commit/dc8de426066969a3f0624fdc2a7b29371a2d55bf · Nota
• https://github.com/openstack/nova/commit/d416f4310bb946b4b127201ec3c37e530d988714 · Nota
• https://github.com/openstack/nova/commit/25e761acd56d4c820273fc0245ada06c500c1637 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2014-112.yaml · Nota
• https://osv.dev/vulnerability/USN-2247-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-0167 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-0134 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-0134 · Nota de Segurança
• https://ubuntu.com/security/CVE-2013-6491 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-0134 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2013-7130 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2014-0134 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2013-4469 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2013-1068 · Aviso do Fabricante