PT-2015-4548 · Openstack · Openstack Compute

Brian Manifold · Published 2015-04-01 · Updated 2023-02-13 · CVE-2015-0259

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions prior to 2014.1.4 OpenStack Compute (Nova) 2014.2.x versions prior to 2014.2.3 OpenStack Compute (Nova) kilo versions prior to kilo-3

Description The issue concerns the failure to validate the origin of websocket requests. This allows remote attackers to hijack user authentication for console access through a manipulated webpage.

Recommendations For OpenStack Compute (Nova) versions prior to 2014.1.4, update to version 2014.1.4 or later. For OpenStack Compute (Nova) 2014.2.x versions prior to 2014.2.3, update to version 2014.2.3 or later. For OpenStack Compute (Nova) kilo versions prior to kilo-3, update to version kilo-3 or later.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2015-0259

GHSA-X8XR-RM9R-7MVF

RHSA-2015:0790

RHSA-2015:0843

RHSA-2015:0844

SUSE-RU-2015:1730-1

SUSE-SU-2015:1666-1

Affected Products

Openstack Compute

References · 45

• https://nvd.nist.gov/vuln/detail/CVE-2015-0259 · Security Note
• https://osv.dev/vulnerability/SUSE-RU-2015:1730-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0844.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2015-0259 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-0259 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0790.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2015-0843.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-0259 · Vendor Advisory
• http://lists.openstack.org/pipermail/openstack-announce/2015-March/000341.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x8xr-rm9r-7mvf · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-0259 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-0259 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2015:1666-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-0259 · Security Note
• https://suse.com/support/update/announcement//suse-ru-20151730-1 · Note