CVE-2014-0134: Infoleak
Published May 8, 2014
·Updated
The instance rescue mode in OpenStack Compute (Nova) 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images and usecowimages is set to false, allows remote authenticated users to read certain compute host files by overwriting an instance disk with a crafted image.
Affected Software
4 affected componentsFixes available
pip/nova<12.0.0a0
12.0.0a0
Openstack Compute=2013.2
Openstack Compute=2013.2.1
Openstack Compute=2013.2.2
Event History
May 8, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:29 PM
DescriptionSeverityWeaknessAffected Software
May 17, 2022
Advisory Published
via GitHub·04:41 AM
Frequently Asked Questions
1
What is the severity of CVE-2014-0134?
CVE-2014-0134 is rated as a medium severity vulnerability.
2
How do I fix CVE-2014-0134?
To fix CVE-2014-0134, upgrade to OpenStack Compute version 2013.2.3 or later.
3
What systems are affected by CVE-2014-0134?
CVE-2014-0134 affects OpenStack Compute versions 2013.2, 2013.2.1, and 2013.2.2.
4
Who can exploit CVE-2014-0134?
Remote authenticated users can exploit CVE-2014-0134 to read certain compute host files.
5
What is the exploit vector for CVE-2014-0134?
The exploit vector for CVE-2014-0134 involves overwriting an instance disk with a crafted image while using libvirt.