The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by putting the VM into the rescue state, suspending it, which puts into an ERROR state, and then deleting the image. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-2573.
CVSS Details
- CVSS 3.1 Base Score: 3.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade nova | Jul 30, 2024 | Oct 6, 2014 |
| Oracle Solaris | — | Upgrade cloud/openstack/nova to version 0.2013.2.3-0.175.2.4.0.2.0 on Solaris 11.2 | May 29, 2017 | Oct 6, 2014 |
| Ubuntu | — | Upgrade python-nova | Nov 8, 2024 | Oct 6, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub