PT-2012-6312 · Openstack · Openstack Compute

Published 2012-06-07 · Updated 2012-06-07

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Openstack Compute (Nova) versions 2011.3 through 2012.1

Description The issue allows remote authenticated users with certain permissions to cause a denial of service by consuming CPU and hard drive resources via a network request that triggers a large number of iptables rules, due to the lack of limitation on the number of security group rules.

Recommendations For versions 2011.3 through 2012.1, consider implementing a limit on the number of security group rules to prevent excessive resource consumption. As a temporary workaround, restrict access to security group rule management for users with certain permissions to minimize the risk of exploitation.

Related Identifiers

PYSEC-2012-36

Affected Products

Openstack Compute

References · 13

• https://osv.dev/vulnerability/PYSEC-2012-36 · Vendor Advisory
• https://github.com/openstack/nova/commit/8c8735a73afb16d5856f0aa6088e9ae406c52beb · Note
• https://github.com/openstack/nova/commit/1f644d210557b1254f7c7b39424b09a45329ade7 · Note
• https://github.com/openstack/nova/commit/a67db4586f70ed881d65e80035b2a25be195ce64 · Note
• http://secunia.com/advisories/49034 · Note
• https://bugs.launchpad.net/nova/+bug/969545 · Note
• http://ubuntu.com/usn/usn-1438-1 · Note
• http://osvdb.org/81641 · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079434.html · Note
• https://lists.launchpad.net/openstack/msg10268.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/75243 · Note
• http://secunia.com/advisories/49048 · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079551.html · Note