rhsa-2014_0231
Vulnerability from csaf_redhat
Published
2014-03-04 19:00
Modified
2024-11-22 07:43
Summary
Red Hat Security Advisory: openstack-nova security and bug fix update

Notes

Topic
Updated openstack-nova packages that fix multiple security issues and several bugs are now available for Red Hat Enterprise Linux OpenStack Platform 4.0. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Details
OpenStack Compute (nova) launches and schedules large networks of virtual machines, creating a redundant and scalable cloud computing platform. Compute provides the software, control panels, and APIs required to orchestrate a cloud, including running virtual machine instances, managing networks, and controlling access through users and projects. It was discovered that the metadata agent in OpenStack Networking was missing an authorization check on the device ID that is bound to a specific port. A remote tenant could guess the instance ID bound to a port and retrieve metadata of another tenant, resulting in information disclosure. Note that only OpenStack Networking setups running neutron-metadata-agent were affected. (CVE-2013-6419) It was found that nova used directories that were writable to by all local users to temporarily store live snapshots. A local attacker with access to such a directory could use this flaw to read and modify the contents of live snapshots. (CVE-2013-7048) A flaw was found in the way the libvirt driver handled short-lived disk back-up files on Compute nodes. An authenticated attacker could use this flaw to create a large number of such files, exhausting all available space on Compute node disks, and potentially causing a denial of service. Note that only Compute setups using the libvirt driver were affected. (CVE-2013-6437) It was discovered that the libvirt driver did not properly handle live migration of virtual machines. An authenticated attacker could use this flaw to gain access to a snapshot of a migrated virtual machine. Note that only setups using KVM live block migration were affected. (CVE-2013-7130) Red Hat would like to thank the OpenStack Project for reporting CVE-2013-6419, CVE-2013-6437, and CVE-2013-7130. Upstream acknowledges Aaron Rosen of VMware as the original reporter of CVE-2013-6419, Phil Day from HP as the original reporter of CVE-2013-6437, and Loganathan Parthipan as the original reporter of CVE-2013-7130. These updated openstack-nova packages have been upgraded to upstream version 2013.2.2, which provides a number of bug fixes over the previous version. (BZ#1065317) Bug fixes: * The GlusterFS volume connector in nova did not pass a port to libvirt for the GlusterFS disk specification. Attaching a volume failed with a libvirt error indicating the port field was missing. This update fixes this bug by providing the default Gluster port in nova. (BZ#1020979) * The database back end did not handle the 2013 MySQL error code (Lost connection). The 2013 MySQL error code has been added to the collection of known database error codes. (BZ#1060771) * OpenStack Compute set the smbios product/vendor information to OpenStack values, which Red Hat Satellite 5 did not recognize when processing entitlements. (BZ#1059414) * Prior to this update, nova-api did not pass the absolute path of the configuration file to the api-paste library if a file with the same name was found in the current directory. (BZ#1039554) * The definition of the libvirt_info method in the RBD back-end class was missing a positional argument that the base class defined. (BZ#1063445) * Rebooting a host caused all of its instances to stop and change to the SHUTDOWN power state. The unpause action was only allowed on instances with the PAUSED power state. (BZ#1047863) * The previous default of writing zeros over deleted volumes took a significant amount of time. It is now possible to set a global configuration setting to clear only a part of a volume, or to disable clearing completely. Additionally, a new 'shred' capability is available to overwrite volumes with random data instead of zeros. (BZ#1062377) * In OpenStack Compute, low-level QPID debug log messages are no longer shown by default. These previously appeared due to the 'level=debug' parameter set in the nova.conf file. (BZ#1047849) All openstack-nova users are advised to upgrade to these updated packages, which correct these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated openstack-nova packages that fix multiple security issues and\nseveral bugs are now available for Red Hat Enterprise Linux OpenStack\nPlatform 4.0.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "OpenStack Compute (nova) launches and schedules large networks of virtual\nmachines, creating a redundant and scalable cloud computing platform.\nCompute provides the software, control panels, and APIs required to\norchestrate a cloud, including running virtual machine instances, managing\nnetworks, and controlling access through users and projects.\n\nIt was discovered that the metadata agent in OpenStack Networking was\nmissing an authorization check on the device ID that is bound to a specific\nport. A remote tenant could guess the instance ID bound to a port and\nretrieve metadata of another tenant, resulting in information disclosure.\nNote that only OpenStack Networking setups running neutron-metadata-agent\nwere affected. (CVE-2013-6419)\n\nIt was found that nova used directories that were writable to by all local\nusers to temporarily store live snapshots. A local attacker with access to\nsuch a directory could use this flaw to read and modify the contents of\nlive snapshots. (CVE-2013-7048)\n\nA flaw was found in the way the libvirt driver handled short-lived disk\nback-up files on Compute nodes. An authenticated attacker could use this\nflaw to create a large number of such files, exhausting all available space\non Compute node disks, and potentially causing a denial of service.\nNote that only Compute setups using the libvirt driver were affected.\n(CVE-2013-6437)\n\nIt was discovered that the libvirt driver did not properly handle live\nmigration of virtual machines. An authenticated attacker could use this\nflaw to gain access to a snapshot of a migrated virtual machine. Note that\nonly setups using KVM live block migration were affected. (CVE-2013-7130)\n\nRed Hat would like to thank the OpenStack Project for reporting\nCVE-2013-6419, CVE-2013-6437, and CVE-2013-7130. Upstream acknowledges\nAaron Rosen of VMware as the original reporter of CVE-2013-6419, Phil Day\nfrom HP as the original reporter of CVE-2013-6437, and Loganathan Parthipan\nas the original reporter of CVE-2013-7130.\n\nThese updated openstack-nova packages have been upgraded to upstream\nversion 2013.2.2, which provides a number of bug fixes over the previous\nversion. (BZ#1065317)\n\nBug fixes:\n\n* The GlusterFS volume connector in nova did not pass a port to libvirt for\nthe GlusterFS disk specification. Attaching a volume failed with a libvirt\nerror indicating the port field was missing. This update fixes this bug by\nproviding the default Gluster port in nova. (BZ#1020979)\n\n* The database back end did not handle the 2013 MySQL error code (Lost\nconnection). The 2013 MySQL error code has been added to the collection of\nknown database error codes. (BZ#1060771)\n\n* OpenStack Compute set the smbios product/vendor information to OpenStack\nvalues, which Red Hat Satellite 5 did not recognize when processing\nentitlements. (BZ#1059414)\n\n* Prior to this update, nova-api did not pass the absolute path of the\nconfiguration file to the api-paste library if a file with the same name\nwas found in the current directory. (BZ#1039554)\n\n* The definition of the libvirt_info method in the RBD back-end class was\nmissing a positional argument that the base class defined. (BZ#1063445)\n\n* Rebooting a host caused all of its instances to stop and change to the\nSHUTDOWN power state. The unpause action was only allowed on instances with\nthe PAUSED power state. (BZ#1047863)\n\n* The previous default of writing zeros over deleted volumes took a\nsignificant amount of time. It is now possible to set a global\nconfiguration setting to clear only a part of a volume, or to disable\nclearing completely. Additionally, a new \u0027shred\u0027 capability is available to\noverwrite volumes with random data instead of zeros. (BZ#1062377)\n\n* In OpenStack Compute, low-level QPID debug log messages are no longer\nshown by default. These previously appeared due to the \u0027level=debug\u0027\nparameter set in the nova.conf file. (BZ#1047849)\n\nAll openstack-nova users are advised to upgrade to these updated packages,\nwhich correct these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0231",
        "url": "https://access.redhat.com/errata/RHSA-2014:0231"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1020979",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1020979"
      },
      {
        "category": "external",
        "summary": "1039148",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1039148"
      },
      {
        "category": "external",
        "summary": "1039554",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1039554"
      },
      {
        "category": "external",
        "summary": "1040786",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1040786"
      },
      {
        "category": "external",
        "summary": "1043106",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1043106"
      },
      {
        "category": "external",
        "summary": "1047849",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1047849"
      },
      {
        "category": "external",
        "summary": "1047863",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1047863"
      },
      {
        "category": "external",
        "summary": "1055400",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1055400"
      },
      {
        "category": "external",
        "summary": "1060771",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1060771"
      },
      {
        "category": "external",
        "summary": "1062377",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062377"
      },
      {
        "category": "external",
        "summary": "1065317",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065317"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0231.json"
      }
    ],
    "title": "Red Hat Security Advisory: openstack-nova security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-22T07:43:09+00:00",
      "generator": {
        "date": "2024-11-22T07:43:09+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2014:0231",
      "initial_release_date": "2014-03-04T19:00:29+00:00",
      "revision_history": [
        {
          "date": "2014-03-04T19:00:29+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-03-04T19:00:29+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T07:43:09+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux OpenStack Platform 4.0",
                "product": {
                  "name": "Red Hat Enterprise Linux OpenStack Platform 4.0",
                  "product_id": "6Server-RHOS-4.0",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:4::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-nova-common-0:2013.2.2-2.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-common-0:2013.2.2-2.el6ost.noarch",
                  "product_id": "openstack-nova-common-0:2013.2.2-2.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-common@2013.2.2-2.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-network-0:2013.2.2-2.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-network-0:2013.2.2-2.el6ost.noarch",
                  "product_id": "openstack-nova-network-0:2013.2.2-2.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-network@2013.2.2-2.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-api-0:2013.2.2-2.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-api-0:2013.2.2-2.el6ost.noarch",
                  "product_id": "openstack-nova-api-0:2013.2.2-2.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-api@2013.2.2-2.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-cert-0:2013.2.2-2.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-cert-0:2013.2.2-2.el6ost.noarch",
                  "product_id": "openstack-nova-cert-0:2013.2.2-2.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-cert@2013.2.2-2.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-0:2013.2.2-2.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-0:2013.2.2-2.el6ost.noarch",
                  "product_id": "openstack-nova-0:2013.2.2-2.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova@2013.2.2-2.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-scheduler-0:2013.2.2-2.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-scheduler-0:2013.2.2-2.el6ost.noarch",
                  "product_id": "openstack-nova-scheduler-0:2013.2.2-2.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-scheduler@2013.2.2-2.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-nova-0:2013.2.2-2.el6ost.noarch",
                "product": {
                  "name": "python-nova-0:2013.2.2-2.el6ost.noarch",
                  "product_id": "python-nova-0:2013.2.2-2.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-nova@2013.2.2-2.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-compute-0:2013.2.2-2.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-compute-0:2013.2.2-2.el6ost.noarch",
                  "product_id": "openstack-nova-compute-0:2013.2.2-2.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-compute@2013.2.2-2.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-objectstore-0:2013.2.2-2.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-objectstore-0:2013.2.2-2.el6ost.noarch",
                  "product_id": "openstack-nova-objectstore-0:2013.2.2-2.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-objectstore@2013.2.2-2.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-conductor-0:2013.2.2-2.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-conductor-0:2013.2.2-2.el6ost.noarch",
                  "product_id": "openstack-nova-conductor-0:2013.2.2-2.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-conductor@2013.2.2-2.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-doc-0:2013.2.2-2.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-doc-0:2013.2.2-2.el6ost.noarch",
                  "product_id": "openstack-nova-doc-0:2013.2.2-2.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-doc@2013.2.2-2.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-console-0:2013.2.2-2.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-console-0:2013.2.2-2.el6ost.noarch",
                  "product_id": "openstack-nova-console-0:2013.2.2-2.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-console@2013.2.2-2.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-novncproxy-0:2013.2.2-2.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-novncproxy-0:2013.2.2-2.el6ost.noarch",
                  "product_id": "openstack-nova-novncproxy-0:2013.2.2-2.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-novncproxy@2013.2.2-2.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-cells-0:2013.2.2-2.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-cells-0:2013.2.2-2.el6ost.noarch",
                  "product_id": "openstack-nova-cells-0:2013.2.2-2.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-cells@2013.2.2-2.el6ost?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-nova-0:2013.2.2-2.el6ost.src",
                "product": {
                  "name": "openstack-nova-0:2013.2.2-2.el6ost.src",
                  "product_id": "openstack-nova-0:2013.2.2-2.el6ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova@2013.2.2-2.el6ost?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-0:2013.2.2-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
          "product_id": "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.noarch"
        },
        "product_reference": "openstack-nova-0:2013.2.2-2.el6ost.noarch",
        "relates_to_product_reference": "6Server-RHOS-4.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-0:2013.2.2-2.el6ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
          "product_id": "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.src"
        },
        "product_reference": "openstack-nova-0:2013.2.2-2.el6ost.src",
        "relates_to_product_reference": "6Server-RHOS-4.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-api-0:2013.2.2-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
          "product_id": "6Server-RHOS-4.0:openstack-nova-api-0:2013.2.2-2.el6ost.noarch"
        },
        "product_reference": "openstack-nova-api-0:2013.2.2-2.el6ost.noarch",
        "relates_to_product_reference": "6Server-RHOS-4.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-cells-0:2013.2.2-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
          "product_id": "6Server-RHOS-4.0:openstack-nova-cells-0:2013.2.2-2.el6ost.noarch"
        },
        "product_reference": "openstack-nova-cells-0:2013.2.2-2.el6ost.noarch",
        "relates_to_product_reference": "6Server-RHOS-4.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-cert-0:2013.2.2-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
          "product_id": "6Server-RHOS-4.0:openstack-nova-cert-0:2013.2.2-2.el6ost.noarch"
        },
        "product_reference": "openstack-nova-cert-0:2013.2.2-2.el6ost.noarch",
        "relates_to_product_reference": "6Server-RHOS-4.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-common-0:2013.2.2-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
          "product_id": "6Server-RHOS-4.0:openstack-nova-common-0:2013.2.2-2.el6ost.noarch"
        },
        "product_reference": "openstack-nova-common-0:2013.2.2-2.el6ost.noarch",
        "relates_to_product_reference": "6Server-RHOS-4.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-compute-0:2013.2.2-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
          "product_id": "6Server-RHOS-4.0:openstack-nova-compute-0:2013.2.2-2.el6ost.noarch"
        },
        "product_reference": "openstack-nova-compute-0:2013.2.2-2.el6ost.noarch",
        "relates_to_product_reference": "6Server-RHOS-4.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-conductor-0:2013.2.2-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
          "product_id": "6Server-RHOS-4.0:openstack-nova-conductor-0:2013.2.2-2.el6ost.noarch"
        },
        "product_reference": "openstack-nova-conductor-0:2013.2.2-2.el6ost.noarch",
        "relates_to_product_reference": "6Server-RHOS-4.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-console-0:2013.2.2-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
          "product_id": "6Server-RHOS-4.0:openstack-nova-console-0:2013.2.2-2.el6ost.noarch"
        },
        "product_reference": "openstack-nova-console-0:2013.2.2-2.el6ost.noarch",
        "relates_to_product_reference": "6Server-RHOS-4.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-doc-0:2013.2.2-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
          "product_id": "6Server-RHOS-4.0:openstack-nova-doc-0:2013.2.2-2.el6ost.noarch"
        },
        "product_reference": "openstack-nova-doc-0:2013.2.2-2.el6ost.noarch",
        "relates_to_product_reference": "6Server-RHOS-4.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-network-0:2013.2.2-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
          "product_id": "6Server-RHOS-4.0:openstack-nova-network-0:2013.2.2-2.el6ost.noarch"
        },
        "product_reference": "openstack-nova-network-0:2013.2.2-2.el6ost.noarch",
        "relates_to_product_reference": "6Server-RHOS-4.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-novncproxy-0:2013.2.2-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
          "product_id": "6Server-RHOS-4.0:openstack-nova-novncproxy-0:2013.2.2-2.el6ost.noarch"
        },
        "product_reference": "openstack-nova-novncproxy-0:2013.2.2-2.el6ost.noarch",
        "relates_to_product_reference": "6Server-RHOS-4.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-objectstore-0:2013.2.2-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
          "product_id": "6Server-RHOS-4.0:openstack-nova-objectstore-0:2013.2.2-2.el6ost.noarch"
        },
        "product_reference": "openstack-nova-objectstore-0:2013.2.2-2.el6ost.noarch",
        "relates_to_product_reference": "6Server-RHOS-4.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-scheduler-0:2013.2.2-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
          "product_id": "6Server-RHOS-4.0:openstack-nova-scheduler-0:2013.2.2-2.el6ost.noarch"
        },
        "product_reference": "openstack-nova-scheduler-0:2013.2.2-2.el6ost.noarch",
        "relates_to_product_reference": "6Server-RHOS-4.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-nova-0:2013.2.2-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
          "product_id": "6Server-RHOS-4.0:python-nova-0:2013.2.2-2.el6ost.noarch"
        },
        "product_reference": "python-nova-0:2013.2.2-2.el6ost.noarch",
        "relates_to_product_reference": "6Server-RHOS-4.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "OpenStack Project"
          ]
        },
        {
          "names": [
            "Aaron Rosen"
          ],
          "organization": "VMware",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2013-6419",
      "discovery_date": "2013-12-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1039148"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Nova: Metadata queries from Neutron to Nova are not restricted by tenant",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.src",
          "6Server-RHOS-4.0:openstack-nova-api-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-cells-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-cert-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-common-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-compute-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-conductor-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-console-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-doc-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-network-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-novncproxy-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-objectstore-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-scheduler-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:python-nova-0:2013.2.2-2.el6ost.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-6419"
        },
        {
          "category": "external",
          "summary": "RHBZ#1039148",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1039148"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-6419",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-6419"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6419",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6419"
        }
      ],
      "release_date": "2013-12-11T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-03-04T19:00:29+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.src",
            "6Server-RHOS-4.0:openstack-nova-api-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-cells-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-cert-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-common-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-compute-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-conductor-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-console-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-doc-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-network-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-novncproxy-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-objectstore-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-scheduler-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:python-nova-0:2013.2.2-2.el6ost.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0231"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 4.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.src",
            "6Server-RHOS-4.0:openstack-nova-api-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-cells-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-cert-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-common-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-compute-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-conductor-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-console-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-doc-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-network-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-novncproxy-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-objectstore-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-scheduler-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:python-nova-0:2013.2.2-2.el6ost.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Nova: Metadata queries from Neutron to Nova are not restricted by tenant"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "OpenStack project"
          ]
        },
        {
          "names": [
            "Phil Day"
          ],
          "organization": "HP",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2013-6437",
      "discovery_date": "2013-12-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1043106"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The libvirt driver in OpenStack Compute (Nova) before 2013.2.2 and icehouse before icehouse-2 allows remote authenticated users to cause a denial of service (disk consumption) by creating and deleting instances with unique os_type settings, which triggers the creation of a new ephemeral disk backing file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "openstack-nova: DoS through ephemeral disk backing files",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Product Security has rated this issue as having moderate security impact in Red Hat OpenStack Platform 3.0. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.src",
          "6Server-RHOS-4.0:openstack-nova-api-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-cells-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-cert-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-common-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-compute-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-conductor-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-console-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-doc-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-network-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-novncproxy-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-objectstore-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-scheduler-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:python-nova-0:2013.2.2-2.el6ost.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-6437"
        },
        {
          "category": "external",
          "summary": "RHBZ#1043106",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1043106"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-6437",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-6437"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6437",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6437"
        }
      ],
      "release_date": "2013-12-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-03-04T19:00:29+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.src",
            "6Server-RHOS-4.0:openstack-nova-api-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-cells-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-cert-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-common-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-compute-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-conductor-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-console-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-doc-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-network-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-novncproxy-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-objectstore-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-scheduler-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:python-nova-0:2013.2.2-2.el6ost.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0231"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.src",
            "6Server-RHOS-4.0:openstack-nova-api-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-cells-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-cert-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-common-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-compute-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-conductor-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-console-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-doc-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-network-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-novncproxy-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-objectstore-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-scheduler-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:python-nova-0:2013.2.2-2.el6ost.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "openstack-nova: DoS through ephemeral disk backing files"
    },
    {
      "cve": "CVE-2013-7048",
      "discovery_date": "2013-12-12T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1040786"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "OpenStack Compute (Nova) Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the temporary directory used to store live snapshots, which allows local users to read and modify live snapshots.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Nova: insecure directory permissions in snapshots",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.src",
          "6Server-RHOS-4.0:openstack-nova-api-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-cells-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-cert-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-common-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-compute-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-conductor-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-console-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-doc-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-network-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-novncproxy-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-objectstore-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-scheduler-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:python-nova-0:2013.2.2-2.el6ost.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-7048"
        },
        {
          "category": "external",
          "summary": "RHBZ#1040786",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1040786"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-7048",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-7048"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-7048",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7048"
        }
      ],
      "release_date": "2013-09-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-03-04T19:00:29+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.src",
            "6Server-RHOS-4.0:openstack-nova-api-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-cells-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-cert-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-common-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-compute-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-conductor-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-console-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-doc-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-network-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-novncproxy-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-objectstore-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-scheduler-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:python-nova-0:2013.2.2-2.el6ost.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0231"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.src",
            "6Server-RHOS-4.0:openstack-nova-api-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-cells-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-cert-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-common-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-compute-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-conductor-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-console-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-doc-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-network-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-novncproxy-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-objectstore-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-scheduler-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:python-nova-0:2013.2.2-2.el6ost.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Nova: insecure directory permissions in snapshots"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "OpenStack project"
          ]
        }
      ],
      "cve": "CVE-2013-7130",
      "discovery_date": "2013-01-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1055400"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nova: Live migration can leak root disk into ephemeral storage",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.src",
          "6Server-RHOS-4.0:openstack-nova-api-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-cells-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-cert-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-common-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-compute-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-conductor-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-console-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-doc-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-network-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-novncproxy-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-objectstore-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:openstack-nova-scheduler-0:2013.2.2-2.el6ost.noarch",
          "6Server-RHOS-4.0:python-nova-0:2013.2.2-2.el6ost.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-7130"
        },
        {
          "category": "external",
          "summary": "RHBZ#1055400",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1055400"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-7130",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-7130"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-7130",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-7130"
        }
      ],
      "release_date": "2014-01-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-03-04T19:00:29+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.src",
            "6Server-RHOS-4.0:openstack-nova-api-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-cells-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-cert-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-common-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-compute-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-conductor-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-console-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-doc-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-network-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-novncproxy-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-objectstore-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-scheduler-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:python-nova-0:2013.2.2-2.el6ost.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0231"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "NONE",
            "baseScore": 3.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-0:2013.2.2-2.el6ost.src",
            "6Server-RHOS-4.0:openstack-nova-api-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-cells-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-cert-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-common-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-compute-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-conductor-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-console-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-doc-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-network-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-novncproxy-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-objectstore-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:openstack-nova-scheduler-0:2013.2.2-2.el6ost.noarch",
            "6Server-RHOS-4.0:python-nova-0:2013.2.2-2.el6ost.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nova: Live migration can leak root disk into ephemeral storage"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.