Unscored severity · published Jun 21, 2012
CVE-2012-2654
The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created…
–
CVSS
2.6%
EPSS
No
On KEV
Description
The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.6% · higher than 85% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Compute · Openstack
2012.2 · source: NVD
DI
Diablo · Openstack
2011.3 · source: NVD
ES
Essex · Openstack
2012.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-2654
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-2654
Vendor Advisory
http://secunia.com/advisories/46808
Vendor Advisory
http://secunia.com/advisories/49439
www.ubuntu.com
http://www.ubuntu.com/usn/USN-1466-1
Patch
https://bugs.launchpad.net/nova/+bug/985184
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/76110
Exploit
https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09beac2978
More from Compute
5.9
CVE-2013-2255
HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates
4.7
CVE-2015-2687
OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would normally not have permissions for
–
CVE-2014-0134
The instance rescue mode in OpenStack Compute (Nova) 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images and use_cow_images is set to false,…
–
CVE-2014-0167
The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1)…
–
CVE-2014-2573
The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote authenticated users to bypass the quota…