Date: Wed, 7 Oct 2015 18:33:38 +0000 From: Tristan Cacqueray <tdecacqu@...hat.com> To: oss-security@...ts.openwall.com Subject: [OSSA 2015-021] Nova network security group changes are not applied to running instances (CVE-2015-7713) ======================================================================================= OSSA-2015-021: Nova network security group changes are not applied to running instances ======================================================================================= :Date: October 06, 2015 :CVE: CVE-2015-7713 Affects ~~~~~~~ - Nova: <=2014.2.3, >=2015.1.0, <=2015.1.1 Description ~~~~~~~~~~~ Sreekumar S. and Suntao independently reported a vulnerability in Nova network. Security group changes silently fail to be applied to already running instances, potentially resulting in instances not being protected by the security group. All Nova network setups are affected. Patches ~~~~~~~ - https://review.openstack.org/222026 (Juno) - https://review.openstack.org/222023 (Kilo) - https://review.openstack.org/222022 (Liberty) Credits ~~~~~~~ - Sreekumar S. (CVE-2015-7713) - Suntao (CVE-2015-7713) References ~~~~~~~~~~ - https://bugs.launchpad.net/bugs/1491307 - https://bugs.launchpad.net/bugs/1484738 - http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7713 Notes ~~~~~ - This fix will be included in future 2014.2.4 (juno) and 2015.1.2 (kilo) releases. -- Tristan Cacqueray OpenStack Vulnerability Management Team Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ