PT-2018-6722 · Openstack+2 · Openstack Nova+2

Lee Yarwood · Publicado 2018-02-19 · Atualizado 2023-02-13 · CVE-2017-18191

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: OpenStack Nova versions 15.x through 15.1.0 OpenStack Nova versions 16.x through 16.1.1

Description: An issue in OpenStack Nova allows an attacker to access the underlying raw volume and corrupt the LUKS header by detaching and reattaching an encrypted volume. This results in a denial of service attack on the compute host. All Nova setups that support encrypted volumes are affected.

Recommendations: For OpenStack Nova versions 15.x through 15.1.0, update to a version that fixes the issue to prevent denial of service attacks. For OpenStack Nova versions 16.x through 16.1.1, update to a version that fixes the issue to prevent denial of service attacks.

Exploit

Correção

Identificadores relacionados

CVE-2017-18191

GHSA-FFMH-R67W-M88F

RHSA-2018:2332

RHSA-2018:2714

RHSA-2018:2855

SUSE-SU-2018:1448-1

USN-5866-1

Produtos afetados

Linuxmint

Openstack Nova

Ubuntu

Referências · 32

• 🔥 https://review.openstack.org/539893 · Exploit
• 🔥 https://launchpad.net/bugs/1739593 · Exploit
• https://github.com/openstack/nova · Nota
• https://github.com/openstack/nova/commit/cd3eb60c2c00bcccfa9ccd4bf9d1a96ae7a5cd88 · Nota
• https://github.com/openstack/nova/commit/5b64a1936122eeb35f37a09f9d38159e1a224c58 · Nota
• https://github.com/openstack/nova/commit/0225a61fc4557c1257383a654f0741f7ef2ddeac · Nota
• https://osv.dev/vulnerability/SUSE-SU-2018:1448-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2022-37394 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2017-18191 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-18191 · Nota
• https://security-tracker.debian.org/tracker/CVE-2017-18191 · Aviso do Fabricante
• https://security.openstack.org/ossa/OSSA-2018-001.html · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2018:2332 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-ffmh-r67w-m88f · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2017-18191 · Nota de Segurança