PT-2017-14361 · Openstack · Openstack Nova

George Shuklin · Publicado 2017-11-14 · Atualizado 2022-05-13 · CVE-2017-16239

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Nova versions 14.0.0 through 14.0.9 OpenStack Nova versions 15.0.0 through 15.0.7 OpenStack Nova versions 16.0.0 through 16.0.2

Description The issue allows an authenticated user to bypass imposed filters, such as the ImagePropertiesFilter or the IsolatedHostsFilter, in the Nova Filter Scheduler by rebuilding an instance. All setups using Nova Filter Scheduler are affected.

Recommendations For OpenStack Nova versions 14.0.0 through 14.0.9, update to a version after 14.0.10. For OpenStack Nova versions 15.0.0 through 15.0.7, update to a version after 15.0.8. For OpenStack Nova versions 16.0.0 through 16.0.2, update to a version after 16.0.3.

Correção

Identificadores relacionados

CVE-2017-16239

DSA-4056-1

GHSA-W2WF-CGWH-VPQG

RHSA-2018:0241

RHSA-2018:0314

RHSA-2018:0369

SUSE-SU-2017:3080-1

Produtos afetados

Openstack Nova

Referências · 25

• https://github.com/openstack/nova · Nota
• https://github.com/openstack/nova/commit/698b261a5a2a6c0f31ef5059046ef7196d5cba30 · Nota
• https://github.com/openstack/nova/commit/9e2d63da94db63d97bd02e373bfc53d95808b833 · Nota
• https://github.com/openstack/nova/commit/b72105c1c49fcddc94992af63fc2f8078023491a · Nota
• https://github.com/openstack/nova/commit/984dd8ad6add4523d93c7ce5a666a32233e02e34 · Nota
• https://debian.org/security/2017/dsa-4056 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16239 · Nota de Segurança
• https://osv.dev/vulnerability/SUSE-SU-2017:3080-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16239 · Aviso do Fabricante
• https://security.openstack.org/ossa/OSSA-2017-005.html · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:0241 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-16239 · Aviso do Fabricante
• http://securityfocus.com/bid/101950 · Nota
• https://security-tracker.debian.org/tracker/CVE-2017-16239 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:0314 · Aviso do Fabricante