OSSA-2012-007: Security groups fail to be set correctly

Date:June 06, 2012
CVE:CVE-2012-2654

Affects

  • Nova: All versions

Description

HP Cloud Services reported a vulnerability in Nova API handling. When a security group is created via the EC2 or OS API’s that uses a protocol defined in the incorrect case i.e ‘TCP’ rather than ‘tcp’ it causes a later string comparison to fail. This leads to Security Groups not being set correctly. Once he ova DB has been polluted with the incorrect case any subsequent modifications to the security group will also fail. ake Nova resilient to any protocol case inconsistencies that may be in the Nova DB. Users may want to consider sanitizing their database by forcing all protocol entries to lower case, hardening their DB against any failures of future code that may expect the data to be lower case.

Credits

  • HP Cloud Services from HP (CVE-2012-2654)