VulnerabilityModified

CVE-2014-0167

MEDIUM 6.0EPSS 1.65%

Does this matter?

Lower severity and a low EPSS score (1.65%). Track it; it rarely justifies an emergency change on its own.

Description

The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.

CVSS 2.0: 6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
EPSS: 1.65% probability · 75th percentile
CISA KEV: Not listed
Weakness: CWE-264
Affected: openstack/compute · openstack/icehouse
Source: secalert@redhat.com

References

http://www.openwall.com/lists/oss-security/2014/04/09/26Patch
http://www.ubuntu.com/usn/USN-2247-1
https://launchpad.net/bugs/1290537Vendor Advisory
http://www.openwall.com/lists/oss-security/2014/04/09/26Patch
http://www.ubuntu.com/usn/USN-2247-1
https://launchpad.net/bugs/1290537Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.