OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.
Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Link | Tags |
---|---|
http://rhn.redhat.com/errata/RHSA-2013-1199.html | third party advisory vendor advisory |
https://bugs.launchpad.net/nova/+bug/1194093 | third party advisory exploit |
http://seclists.org/oss-sec/2013/q3/281 | mailing list third party advisory patch |