Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 536340 - <sys-cluster/nova-2014.2.1: Multiple vulnerabilities (CVE-2014-{3708,8333,8750})
Summary: <sys-cluster/nova-2014.2.1: Multiple vulnerabilities (CVE-2014-{3708,8333,8750})
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
URL:
Whiteboard: ~3 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2015-01-11 18:30 UTC by GLSAMaker/CVETool Bot
Modified: 2015-01-13 08:52 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2015-01-11 18:30:05 UTC 
CVE-2014-8750 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8750):
  Race condition in the VMware driver in OpenStack Compute (Nova) before
  2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated users to
  access unintended consoles by spawning an instance that triggers the same
  VNC port to be allocated to two different instances.

CVE-2014-8333 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8333):
  The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote
  authenticated users to cause a denial of service (disk consumption) by
  deleting an instance in the resize state.

CVE-2014-3708 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3708):
  OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before 2014.2.1 allows
  remote authenticated users to cause a denial of service (CPU consumption)
  via an IP filter in a list active servers API request.


Maintainer(s), it appears that we just need to drop 2014.2.
Comment 1 Matthew Thode ( prometheanfire ) archtester Gentoo Infrastructure gentoo-dev Security 2015-01-13 04:16:26 UTC 
old badness removed.