Vulnerability Report

CVE-2017-16239

Title: Openstack Nova

Other

Proof Of Concept

No public PoC currently indexed for CVE-2017-16239.

CWE Category NVD-CWE-noinfo

Published Date Nov 14, 2017

Modified Date Jun 17, 2026

Exploit Status Not Found

Score 6.5 CVSS v3.0

Exploit Probability (EPSS)

1.41%

Vulnerability Summary

CVE-2017-16239: In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Because of the regression described in Launchpad Bug #1732947, the preferred fix is a 14.x version after 14.0.10, a 15.x version after 15.0.8, or a 16.x version after 16.0.3.

Impacted Vendors

openstack 1

panic 1

Reference Links

http://www.securityfocus.com/bid/101950 https://access.redhat.com/errata/RHSA-2018:0241 https://access.redhat.com/errata/RHSA-2018:0314 https://access.redhat.com/errata/RHSA-2018:0369 https://launchpad.net/bugs/1664931 https://security.openstack.org/ossa/OSSA-2017-005.html https://www.debian.org/security/2017/dsa-4056 http://www.securityfocus.com/bid/101950 https://access.redhat.com/errata/RHSA-2018:0241 https://access.redhat.com/errata/RHSA-2018:0314 https://access.redhat.com/errata/RHSA-2018:0369 https://launchpad.net/bugs/1664931 https://security.openstack.org/ossa/OSSA-2017-005.html https://www.debian.org/security/2017/dsa-4056

CVSS v3.0

Source Entity [email protected]

Severity MEDIUM

6.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0

Source Entity [email protected]

Severity MEDIUM

4.0

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:N/AC:L/Au:S/C:N/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns