CVE-2014-2573: Medium severity Openstack Compute vulnerability
The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/novato a version that resolves this vulnerability.Fixed in 12.0.0a0
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2573?
CVE-2014-2573 has a medium severity rating due to its potential to bypass quota limits and cause denial of service.
How do I fix CVE-2014-2573?
To fix CVE-2014-2573, upgrade to OpenStack Compute version 12.0.0a0 or later.
Which versions of OpenStack Compute are affected by CVE-2014-2573?
CVE-2014-2573 affects OpenStack Compute versions 2013.2 through 2013.2.2 inclusive.
What kind of attack does CVE-2014-2573 facilitate?
CVE-2014-2573 facilitates resource consumption attacks by allowing remote authenticated users to manipulate VM states.
Is CVE-2014-2573 present in all OpenStack versions?
No, CVE-2014-2573 is only present in specific versions of OpenStack Compute from the 2013.2 series.