Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Fri, 13 Mar 2015 13:46:57 -0400
From: Tristan Cacqueray <>
Subject: [OSSA 2015-005] Nova console Cross-Site WebSocket hijacking (CVE-2015-0259)

OSSA-2015-005: Nova console Cross-Site WebSocket hijacking

:Date: March 13, 2015
:CVE: CVE-2015-0259

- Nova: up to 2014.1.3 and 2014.2 versions up to 2014.2.2

Brian Manifold from Cisco and Paul McMillan from Nebula reported a
vulnerability in Nova console websocket. By tricking an authenticated
user into visiting a malicious URL, a remote attacker or a man in the
middle may exploit a cross-site-websocket-hijacking vulnerability
resulting in potential hijack of consoles where the user is still
logged in. Only Nova setups with vnc or spice enabled are affected.

- (Icehouse)
- (Juno)
- (Kilo)

- Brian Manifold from Cisco (CVE-2015-0259)
- Paul McMillan from Nebula (CVE-2015-0259)


- This fix is included in 2014.1.4 (icehouse) release and it will be included
  in the kilo-3 development milestone and in the future 2014.2.3 (juno)

Tristan Cacqueray
OpenStack Vulnerability Management Team

Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.