Staging Environment: Content and features may be unstable or change without notice.
Advisory details: pypa / nova/PYSEC-2012-37
Advisory ID pypa/nova/PYSEC-2012-37
Aliases CVE-2012-2654
GHSA-46r8-9cj7-pw6g
PYSEC-2012-37
Summary The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
There are no known severity scores.
Reference id Reference type URL
https://bugs.launchpad.net/nova/+bug/985184
http://secunia.com/advisories/46808
http://secunia.com/advisories/49439
https://exchange.xforce.ibmcloud.com/vulnerabilities/76110
https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09beac2978
https://github.com/openstack/nova/commit/ff06c7c885dc94ed7c828e8cdbb8b5d850a7e654
https://lists.launchpad.net/openstack/msg12883.html
https://review.openstack.org/#/c/8239/
http://www.ubuntu.com/usn/USN-1466-1
GHSA-46r8-9cj7-pw6g https://github.com/advisories/GHSA-46r8-9cj7-pw6g

No exploits are available.

No EPSS data available for this advisory.

Patch URL
There are no known patches.

There are no known vectors.

There are no SSVC decisions available.