nova@22.0.0.0rc1 vulnerabilities

Cloud computing fabric controller

Direct Vulnerabilities

Known vulnerabilities in the nova package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Denial of Service (DoS)

nova is an OpenStack Nova provides a cloud computing fabric controller, supporting a wide variety of compute technologies, including: libvirt (KVM, Xen, LXC and more), Hyper-V, VMware, XenServer, OpenStack Ironic and PowerVM.

Affected versions of this package are vulnerable to Denial of Service (DoS) by creating a neutron port with the direct vnic_type, then creating an instance bound to that port, and then changing the vnic_type of the bound port to macvtap. Note: Only Nova deployments configured with SR-IOV are affected.

How to fix Denial of Service (DoS)?

A fix was pushed into the master branch but not yet published.

[0,)
  • M
Open Redirect

nova is an OpenStack Nova provides a cloud computing fabric controller, supporting a wide variety of compute technologies, including: libvirt (KVM, Xen, LXC and more), Hyper-V, VMware, XenServer, OpenStack Ironic and PowerVM.

Affected versions of this package are vulnerable to Open Redirect. The console proxies used (novnc, serial, spice) run in a websockify server whose request handler inherits from the python standard SimpleHTTPRequestHandler. There is a known issue in the SimpleHTTPRequestHandler which allows open redirects by way of URLs in the following format: http://vncproxy.my.domain.com//example.com/%2F.., which if visited, will redirect a user to example.com.

How to fix Open Redirect?

Upgrade nova to version 23.0.2, 22.3.0, 21.2.3 or higher.

[23.0.0.0rc1,23.0.2) [22.0.0.0rc1,22.3.0) (,21.2.3)