Bug 536340

Summary:	<sys-cluster/nova-2014.2.1: Multiple vulnerabilities (CVE-2014-{3708,8333,8750})
Product:	Gentoo Security	Reporter:	GLSAMaker/CVETool Bot <glsamaker>
Component:	Vulnerabilities	Assignee:	Gentoo Security <security>
Status:	RESOLVED FIXED
Severity:	trivial
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:	~3 [noglsa]
Package list:		Runtime testing required:	---

Description GLSAMaker/CVETool Bot gentoo-dev

2015-01-11 18:30:05 UTC

CVE-2014-8750 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8750):
  Race condition in the VMware driver in OpenStack Compute (Nova) before
  2014.1.4 and 2014.2 before 2014.2rc1 allows remote authenticated users to
  access unintended consoles by spawning an instance that triggers the same
  VNC port to be allocated to two different instances.

CVE-2014-8333 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-8333):
  The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote
  authenticated users to cause a denial of service (disk consumption) by
  deleting an instance in the resize state.

CVE-2014-3708 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3708):
  OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before 2014.2.1 allows
  remote authenticated users to cause a denial of service (CPU consumption)
  via an IP filter in a list active servers API request.


Maintainer(s), it appears that we just need to drop 2014.2.

Comment 1 Matthew Thode ( prometheanfire ) archtester

2015-01-13 04:16:26 UTC

old badness removed.