CVE-2021-3654: Medium severity openstack compute (nova) vulnerability
A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.
Other sources
novnc allows open redirection, which could allow phishing attempts. Risk: By modifying untrusted URL input to a malicious site, an attacker may successfully launch a phishing scam and steal user credentials. Because the server name in the modified link is identical to the original site, phishing attempts could have a more trustworthy appearance.
https://bugs.launchpad.net/nova/+bug/1927677
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-3654?
CVE-2021-3654 is a vulnerability found in openstack-nova's console proxy, noVNC, that allows for redirecting to any desired URL via a maliciously crafted URL.
How does CVE-2021-3654 affect OpenStack Nova?
CVE-2021-3654 affects OpenStack Nova versions up to 21.2.3, 22.0.0 up to 22.2.3, and 23.0.0 up to 23.0.3.
What is the severity of CVE-2021-3654?
The severity of CVE-2021-3654 is medium, with a CVSS score of 6.1.
How can I fix CVE-2021-3654?
To fix CVE-2021-3654, update OpenStack Nova to version 21.2.4 or higher, versions 22.3.0 or higher, or versions 23.1.0 or higher.
Where can I find more information about CVE-2021-3654?
You can find more information about CVE-2021-3654 at the following references: [Reference 1](https://bugs.launchpad.net/nova/+bug/1927677), [Reference 2](https://bugs.python.org/issue32084), [Reference 3](https://bugzilla.redhat.com/show_bug.cgi?id=1961439).