OSSA-2015-021: Nova network security group changes are not applied to running instances

OSSA-2015-021: Nova network security group changes are not applied to running instances

Date:October 06, 2015
CVE:CVE-2015-7713

Affects

  • Nova: <=2014.2.3, >=2015.1.0, <=2015.1.1

Description

Sreekumar S. and Suntao independently reported a vulnerability in Nova network. Security group changes silently fail to be applied to already running instances, potentially resulting in instances not being protected by the security group. All Nova network setups are affected.

Credits

  • Sreekumar S. (CVE-2015-7713)
  • Suntao (CVE-2015-7713)

Notes

  • This fix will be included in future 2014.2.4 (juno) and 2015.1.2 (kilo) releases.
Creative Commons Attribution 3.0 License

Except where otherwise noted, this document is licensed under Creative Commons Attribution 3.0 License. See all OpenStack Legal Documents.