PyPI: nova
CVE-2012-2654
Safety vulnerability ID: SFTY-20120621-96905
Safety legacy ID: pyup.io-68021
The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.
Overview
OpenStack Compute (Nova) Improper Input Validation
Advisory
The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.
How to Fix
We recommend updating nova to the latest non-vulnerable version.
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20120621-96905/CVE-2012-2654
- https://nvd.nist.gov/vuln/detail/CVE-2012-2654
- https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09beac2978
- https://github.com/openstack/nova/commit/ff06c7c885dc94ed7c828e8cdbb8b5d850a7e654
- https://bugs.launchpad.net/nova/+bug/985184
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76110
- https://lists.launchpad.net/openstack/msg12883.html
- http://www.ubuntu.com/usn/USN-1466-1
- https://review.openstack.org/#/c/8239
- https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2012-37.yaml
- https://github.com/advisories/GHSA-46r8-9cj7-pw6g
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more