CVE-2015-7713: Medium severity openstack compute (nova) vulnerability
OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made.
Other sources
Title: Nova network security group changes are not applied to running instances
Reporter: Sreekumar S and Suntao Products: Nova Affects: <=2014.2.3, >=2015.1.0, <=2015.1.1
Description:
Sreekumar S and Suntao independently reported a vulnerability in Nova network. Security group changes silently fail to be applied to already running instances, potentially resulting in instances not being protected by the security group. All Nova network setups are affected.
References:
https://launchpad.net/bugs/1491307 https://launchpad.net/bugs/1484738 http://seclists.org/oss-sec/2015/q4/41
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7713?
CVE-2015-7713 is classified as a medium severity vulnerability.
What does CVE-2015-7713 allow attackers to do?
CVE-2015-7713 allows remote attackers to bypass security group restrictions on OpenStack Nova.
How do I fix CVE-2015-7713?
To fix CVE-2015-7713, upgrade to OpenStack Nova version 2014.2.4 or 2015.1.2 or later.
Which versions of OpenStack Nova are affected by CVE-2015-7713?
CVE-2015-7713 affects OpenStack Nova versions before 2014.2.4 and 2015.1.x before 2015.1.2.
When was CVE-2015-7713 disclosed?
CVE-2015-7713 was disclosed in 2015.