CVE-2012-2654: Input Validation
The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-2654?
CVE-2012-2654 is considered a medium severity vulnerability due to its potential to allow remote attackers to bypass security restrictions.
How do I fix CVE-2012-2654?
To fix CVE-2012-2654, upgrade the OpenStack Compute (Nova) to version 12.0.0a0 or later.
What versions of OpenStack are affected by CVE-2012-2654?
CVE-2012-2654 affects OpenStack Compute versions 2012.2 (Folsom), 2012.1 (Essex), and 2011.3 (Diablo).
What type of attacks can CVE-2012-2654 facilitate?
CVE-2012-2654 can facilitate unauthorized access by allowing attackers to bypass security group restrictions.
Who can be impacted by CVE-2012-2654?
Users and administrators of OpenStack Compute versions 2011.3, 2012.1, and 2012.2 may be impacted by CVE-2012-2654.