CVE-2012-2654
The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which…
Does this matter?
Lower severity and a low EPSS score (2.63%). Track it; it rarely justifies an emergency change on its own.
Description
The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 2.63% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- openstack/compute · openstack/diablo · openstack/essex
- Source
- secalert@redhat.com
References
- http://secunia.com/advisories/46808Vendor Advisory
- http://secunia.com/advisories/49439Vendor Advisory
- http://www.ubuntu.com/usn/USN-1466-1
- https://bugs.launchpad.net/nova/+bug/985184Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76110
- https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09beac2978Exploit, Patch
- https://github.com/openstack/nova/commit/ff06c7c885dc94ed7c828e8cdbb8b5d850a7e654Exploit, Patch
- https://lists.launchpad.net/openstack/msg12883.html
- https://review.openstack.org/#/c/8239/
- http://secunia.com/advisories/46808Vendor Advisory
- http://secunia.com/advisories/49439Vendor Advisory
- http://www.ubuntu.com/usn/USN-1466-1
- https://bugs.launchpad.net/nova/+bug/985184Patch
- https://exchange.xforce.ibmcloud.com/vulnerabilities/76110
- https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09beac2978Exploit, Patch
- https://github.com/openstack/nova/commit/ff06c7c885dc94ed7c828e8cdbb8b5d850a7e654Exploit, Patch
- https://lists.launchpad.net/openstack/msg12883.html
- https://review.openstack.org/#/c/8239/
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.