CVE-2014-2573
The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the…
Does this matter?
Lower severity and a low EPSS score (0.70%). Track it; it rarely justifies an emergency change on its own.
Description
The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota limit and cause a denial of service (resource consumption) by requesting the VM be put into rescue and then deleting the image.
- CVSS 2.0
- 2.3 LOWAV:A/AC:M/Au:S/C:N/I:N/A:P
- EPSS
- 0.70% probability · 51th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- openstack/compute
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/57498Vendor Advisory
- http://www.openwall.com/lists/oss-security/2014/03/21/1
- http://www.openwall.com/lists/oss-security/2014/03/21/2
- https://bugs.launchpad.net/nova/+bug/1269418
- http://secunia.com/advisories/57498Vendor Advisory
- http://www.openwall.com/lists/oss-security/2014/03/21/1
- http://www.openwall.com/lists/oss-security/2014/03/21/2
- https://bugs.launchpad.net/nova/+bug/1269418
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.