GHSA-67rh-9p29-vrxr

Suggest an improvement
Source
https://github.com/advisories/GHSA-67rh-9p29-vrxr
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-67rh-9p29-vrxr/GHSA-67rh-9p29-vrxr.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-67rh-9p29-vrxr
Aliases
Published
2022-05-14T01:58:45Z
Modified
2024-12-08T05:30:27.417245Z
Summary
OpenStack Compute (Nova) allows remote attackers to bypass intended restriction
Details

OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made.

Database specific 
{
    "nvd_published_at": "2015-10-29T20:59:00Z",
    "cwe_ids": [],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-02-08T18:12:12Z"
}
References

Affected packages

PyPI / nova

Package

Name
nova
View open source insights on deps.dev
Purl
pkg:pypi/nova

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2014.2.4

Affected versions

15.*

15.1.5

16.*

16.1.6
16.1.7
16.1.8

17.*

17.0.7
17.0.8
17.0.9
17.0.10
17.0.11
17.0.12
17.0.13

18.*

18.0.2
18.0.3
18.1.0
18.2.0
18.2.1
18.2.2
18.2.3
18.3.0

19.*

19.0.0.0rc1
19.0.0.0rc2
19.0.0
19.0.1
19.0.2
19.0.3
19.1.0
19.2.0
19.3.0
19.3.1
19.3.2

20.*

20.0.0.0rc1
20.0.0.0rc2
20.0.0
20.0.1
20.1.0
20.1.1
20.2.0
20.3.0
20.4.0
20.4.1
20.5.0
20.6.0
20.6.1

21.*

21.0.0.0rc1
21.0.0.0rc2
21.0.0
21.1.0
21.1.1
21.1.2
21.2.0
21.2.1
21.2.2
21.2.3
21.2.4

22.*

22.0.0.0rc1
22.0.0
22.0.1
22.1.0
22.2.0
22.2.1
22.2.2
22.3.0
22.4.0

23.*

23.0.0.0rc1
23.0.0.0rc2
23.0.0
23.0.1
23.0.2
23.1.0
23.2.0
23.2.1
23.2.2

24.*

24.0.0.0rc1
24.0.0.0rc2
24.0.0
24.1.0
24.1.1
24.2.0
24.2.1

25.*

25.0.0.0rc1
25.0.0
25.0.1
25.1.0
25.1.1
25.2.0
25.2.1
25.3.0

26.*

26.0.0.0rc1
26.0.0.0rc2
26.0.0
26.1.0
26.1.1
26.2.0
26.2.1
26.2.2
26.3.0

27.*

27.0.0.0rc1
27.0.0
27.1.0
27.2.0
27.3.0
27.4.0
27.5.0
27.5.1

28.*

28.0.0.0rc1
28.0.0
28.0.1
28.1.0
28.2.0
28.3.0

29.*

29.0.0.0rc1
29.0.0
29.0.1
29.0.2
29.1.0
29.2.0

30.*

30.0.0.0rc1
30.0.0

PyPI / nova

Package

Name
nova
View open source insights on deps.dev
Purl
pkg:pypi/nova

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2015.1.0
Fixed
2015.1.2