OpenStack Security Advisory: 2012-005 CVE: 2012-2101 Date: April 19, 2012 Title: No quota enforced on security group rules Impact: High Reporter: Dan Prince <dpri...@redhat.com> Products: Nova Affects: All versions
Description: Dan Prince reported a vulnerability in Nova. He discovered that there was no limit on the number of security group rules a user can create. By creating a very large set of rules, an unreasonable number of iptables rules will be created on compute nodes, resulting in a denial of service. Fixes: Folsom: https://github.com/openstack/nova/commit/1f644d210557b1254f7c7b39424b09a45329ade7 2012.1: https://github.com/openstack/nova/commit/a67db4586f70ed881d65e80035b2a25be195ce64 2011.3: https://github.com/openstack/nova/commit/8c8735a73afb16d5856f0aa6088e9ae406c52beb References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=2012-2101 https://bugs.launchpad.net/nova/+bug/969545 -- Russell Bryant OpenStack Vulnerability Management Team _______________________________________________ Mailing list: https://launchpad.net/~openstack Post to : openstack@lists.launchpad.net Unsubscribe : https://launchpad.net/~openstack More help : https://help.launchpad.net/ListHelp
