CVE-2012-2654: Input Validation
First published: Thu Jun 21 2012(Updated: )
The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenStack Compute | =2012.2 | |
| Openstack Diablo | =2011.3 | |
| OpenStack Essex | =2012.1 | |
| pip/nova | <12.0.0a0 | 12.0.0a0 |
| =2012.2 | ||
| =2011.3 | ||
| =2012.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/46808
- http://secunia.com/advisories/49439
- http://www.ubuntu.com/usn/USN-1466-1
- https://bugs.launchpad.net/nova/+bug/985184
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76110
- https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09beac2978
- https://github.com/openstack/nova/commit/ff06c7c885dc94ed7c828e8cdbb8b5d850a7e654
- https://lists.launchpad.net/openstack/msg12883.html
- https://review.openstack.org/#/c/8239/
- https://nvd.nist.gov/vuln/detail/CVE-2012-2654
- https://review.openstack.org/#/c/8239
- https://github.com/advisories/GHSA-46r8-9cj7-pw6g (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2012-37.yaml
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/weakness
- agent/severity
- agent/remedy
- agent/description
- agent/author
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-46r8-9cj7-pw6g
- alias/CVE-2012-2654
- agent/last-modified-date
- agent/references
- agent/tags
- collector/github-advisory
- agent/trending
- vendor/openstack
- canonical/openstack compute
- version/openstack compute/2012.2
- canonical/openstack diablo
- version/openstack diablo/2011.3
- canonical/openstack essex
- version/openstack essex/2012.1
- package-manager/pip