The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.
Advisories
Source ID Title
EUVD EUVD EUVD-2022-4654 The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules, (3) destroy, and other unspecified methods in compute/api.py when using non-default policies, which allows remote authenticated users to gain privileges via these API requests.
Github GHSA Github GHSA GHSA-p258-xmh3-72pv OpenStack Compute (Nova) allows remote authenticated users to gain privileges via API requests
Ubuntu USN Ubuntu USN USN-2247-1 OpenStack Nova vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-06T09:05:38.956Z

Reserved: 2013-12-03T00:00:00

Link: CVE-2014-0167

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2014-04-15T14:55:04.200

Modified: 2025-04-12T10:46:40.837

Link: CVE-2014-0167

cve-icon Redhat

Severity : Moderate

Publid Date: 2014-04-09T00:00:00Z

Links: CVE-2014-0167 - Bugzilla

cve-icon OpenCVE Enrichment

No data.