PT-2012-6313 · Openstack · Openstack Compute

Published 2012-06-21 · Updated 2012-06-21

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions 2011.3 through 2012.2

Description The issue allows remote attackers to bypass intended access restrictions due to improper protocol checking when security groups are created and the network protocol is not specified entirely in lowercase.

Recommendations For OpenStack Compute (Nova) versions 2011.3 through 2012.2, consider updating the API to properly handle protocol specifications. As a temporary workaround, ensure that all network protocols are specified entirely in lowercase when creating security groups.

Related Identifiers

PYSEC-2012-37

Affected Products

Openstack Compute

References · 10

• https://osv.dev/vulnerability/PYSEC-2012-37 · Vendor Advisory
• https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09beac2978 · Note
• https://github.com/openstack/nova/commit/ff06c7c885dc94ed7c828e8cdbb8b5d850a7e654 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/76110 · Note
• http://secunia.com/advisories/49439 · Note
• https://bugs.launchpad.net/nova/+bug/985184 · Note
• http://secunia.com/advisories/46808 · Note
• https://review.openstack.org/#/c/8239 · Note
• http://ubuntu.com/usn/USN-1466-1 · Note
• https://lists.launchpad.net/openstack/msg12883.html · Note