PT-2017-14361 · Openstack · Openstack Nova

George Shuklin · Published 2017-11-14 · Updated 2022-05-13 · CVE-2017-16239

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Nova versions 14.0.0 through 14.0.9 OpenStack Nova versions 15.0.0 through 15.0.7 OpenStack Nova versions 16.0.0 through 16.0.2

Description The issue allows an authenticated user to bypass imposed filters, such as the ImagePropertiesFilter or the IsolatedHostsFilter, in the Nova Filter Scheduler by rebuilding an instance. All setups using Nova Filter Scheduler are affected.

Recommendations For OpenStack Nova versions 14.0.0 through 14.0.9, update to a version after 14.0.10. For OpenStack Nova versions 15.0.0 through 15.0.7, update to a version after 15.0.8. For OpenStack Nova versions 16.0.0 through 16.0.2, update to a version after 16.0.3.

Fix

Related Identifiers

CVE-2017-16239

DSA-4056-1

GHSA-W2WF-CGWH-VPQG

RHSA-2018:0241

RHSA-2018:0314

RHSA-2018:0369

SUSE-SU-2017:3080-1

Affected Products

Openstack Nova

References · 25

• https://debian.org/security/2017/dsa-4056 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16239 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:3080-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-16239 · Vendor Advisory
• https://security.openstack.org/ossa/OSSA-2017-005.html · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0241 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-16239 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-16239 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0314 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0369 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-16239 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-16239 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w2wf-cgwh-vpqg · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4056-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-16239 · Security Note