Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

nova

54 known vulnerabilities (2 high, 5 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
54 · 2 high, 5 medium, 1 low
Weekly downloads
1,487
Dependents
1
Registry
PyPI

Advisories 54

  • CVE-2026-46448Medium 5.4

    In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data.

    Affected: from 18.0.0, fixed in 31.3.1; from 32.0.0, fixed in 32.2.1; from 33.0.0, fixed in 33.0.2; from 18.0.0, through 31.3.0; from 32.0.0, fixed in 32.2.1; from 33.0.0, fixed in 33.0.2.

  • An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1.

    Affected: from 32.0.0.0rc1, through 32.1.0; from 31.0.0.0rc1, through 31.2.0; through 30.2.1; through 30.2.1; from 31.0.0.0rc1, through 31.2.0; from 32.0.0.0rc1, through 32.1.0.

  • CVE-2024-40767Medium 6.5

    In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2…

    Affected: through 27.4.0; from 28.0.0, through 28.2.0; from 29.0.0, through 29.1.0; through 27.4.0; from 28.0.0, through 28.2.0; from 29.0.0, through 29.1.0.

  • CVE-2024-32498Medium 6.5

    An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3.

    Affected: through 29.0.2.

  • CVE-2022-47951Medium 5.7

    An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and…

    Affected: fixed in 24.1.2; from 25.0.0, fixed in 25.0.2; fixed in 24.1.2; from 25.0.0, fixed in 25.0.2.

  • An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2.

    Affected: fixed in 23.2.2; from 24.0.0, fixed in 24.1.2; from 25.0.0, fixed in 25.0.2; fixed in 23.2.2; from 24.0.0, fixed in 24.1.2; from 25.0.0, fixed in 25.0.2.

  • A vulnerability was found in openstack-nova's console proxy, noVNC.

    Affected: fixed in 21.2.3; from 22.0.0, fixed in 22.2.3; from 23.0.0, fixed in 23.0.3; fixed in 21.2.3; from 22.0.0, fixed in 22.2.3; from 23.0.0, fixed in 23.0.3.

  • An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0.

    Affected: fixed in 19.3.1; from 20.0.0, fixed in 20.3.1; versions 21.0.0; fixed in 19.3.1; from 20.0.0, fixed in 20.3.1; from 21.0.0, fixed in 21.1.0.

  • An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0.

    Affected: fixed in 18.2.4; from 19.0.0, fixed in 19.1.0; from 20.0.0, fixed in 20.1.0; fixed in 18.2.4; from 19.0.0, fixed in 19.1.0; from 20.0.0, fixed in 20.1.0.

  • OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY…

    Affected: fixed in 12.0.0a0.

  • An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2.

    Affected: from 19.0.0, fixed in 19.0.2; fixed in 17.0.12; from 18.0.0, fixed in 18.2.2; fixed in 17.0.12; from 18.0.0, fixed in 18.2.2; from 19.0.0, fixed in 19.0.2.

  • qcow format could expose host filesystem information

    Affected: fixed in 12.0.0a0.

  • An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1.

    Affected: from 15.0.0, fixed in 15.1.1; from 16.0.0, fixed in 16.1.2; from 15.0.0, fixed in 15.1.1; from 16.0.0, fixed in 16.1.2.

  • An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3.

    Affected: fixed in 16.0.4.

  • In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be…

    Affected: from 14.0.0, fixed in 14.0.10; from 15.0.0, fixed in 15.0.8; from 16.0.0, fixed in 16.0.3; from 16.0.0, fixed in 16.0.3; from 15.0.0, fixed in 15.0.8; from 14.0.0, fixed in 14.0.10.

Show all 54 advisoriesShow fewer advisories

  • OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local users to access VM volumes that they would…

    Affected: fixed in 15.0.0.0b1.

  • An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1.

    Affected: from 13.0.0, fixed in 13.1.4; from 14.0.0, fixed in 14.0.5; from 15.0.1, fixed in 15.0.2; from 13.0.0, fixed in 13.1.4; from 14.0.0, fixed in 14.0.5; from 15.0.1, fixed in 15.0.2.

  • The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0…

    Affected: fixed in 12.0.4.

  • The libvirt driver in OpenStack Compute (Nova) before 2015.1.4 (kilo) and 12.0.x before 12.0.3 (liberty), when using raw storage and…

    Affected: from 12.0.0, fixed in 12.0.3.

  • The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty)…

    Affected: from 12.0.0, fixed in 12.0.1.

  • OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which…

    Affected: fixed in 2014.2.4; from 2015.1.0, fixed in 2015.1.2; fixed in 2014.2.4; from 2015.1.0, fixed in 2015.1.2.

  • OpenStack Compute (nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) does not properly delete instances from compute nodes…

    Affected: fixed in 2014.2.4; from 2015.1.0, fixed in 2015.1.2; fixed in 2014.2.4; from 2015.1.0, fixed in 2015.1.2.

  • OpenStack Compute (nova) 2015.1 through 2015.1.1, 2014.2.3, and earlier does not stop the migration process when the instance is deleted…

    Affected: fixed in 12.0.0.0b3; fixed in 112.0.0.0b3.

  • OpenStack Compute (Nova) before 2014.1.4, 2014.2.x before 2014.2.3, and kilo before kilo-3 does not validate the origin of websocket…

    Affected: fixed in 2014.1.4; from 2014.2.0, fixed in 2014.2.3; fixed in 2014.1.4; from 2014.2.0, fixed in 2014.2.3.

  • The VMware driver in OpenStack Compute (Nova) before 2014.1.4 allows remote authenticated users to cause a denial of service (disk…

    Affected: fixed in 12.0.0a0.

  • OpenStack Compute (Nova) before 2014.1.4 and 2014.2.x before 2014.2.1 allows remote authenticated users to cause a denial of service (CPU…

    Affected: fixed in 2014.1.4; from 2014.2.0, fixed in 2014.2.1; fixed in 2014.1.4; from 2014.2.0, fixed in 2014.2.1.

  • The VMWare driver in OpenStack Compute (Nova) before 2014.1.3 allows remote authenticated users to bypass the quota limit and cause a…

    Affected: fixed in 2014.1.3.

  • api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying…

    Affected: fixed in 2013.2.4; from 2014.0.0, fixed in 2014.1.2; fixed in 2013.2.4; from 2014.0.0, fixed in 2014.1.2.

  • The instance rescue mode in OpenStack Compute (Nova) 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images…

    Affected: fixed in 12.0.0a0.

  • The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does…

    Affected: from 2013.1.0, fixed in 2013.2.4.

  • The VMWare driver in OpenStack Compute (Nova) 2013.2 through 2013.2.2 does not properly put VMs into RESCUE status, which allows remote…

    Affected: fixed in 12.0.0a0.

  • The libvirt driver in OpenStack Compute (Nova) before 2013.2.2 and icehouse before icehouse-2 allows remote authenticated users to cause a…

    Affected: fixed in 12.0.0a0.

  • The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and…

    Affected: fixed in 12.0.0a0.

  • OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users…

    Affected: fixed in 12.0.0a0.

  • OpenStack Compute (Nova) Grizzly 2013.1.4, Havana 2013.2.1, and earlier uses world-writable and world-readable permissions for the…

    Affected: fixed in 12.0.0a0.

  • Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant…

    Affected: fixed in 12.0.0a0.

  • The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when…

    Affected: fixed in 12.0.0a0.

  • OpenStack Compute (Nova) Folsom, Grizzly, and Havana, when use_cow_images is set to False, does not verify the virtual size of a QCOW2…

    Affected: fixed in 12.0.0a0.

  • Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-3 does not properly handle…

    Affected: fixed in 12.0.0a0.

  • The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the…

    Affected: fixed in 12.0.0a0.

  • The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to…

    Affected: fixed in 2013.2.

  • OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property…

    Affected: fixed in 2013.1.3.

  • OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause…

    Affected: fixed in 12.0.0a0.

  • OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) does not properly implement a quota for fixed IPs, which allows…

    Affected: fixed in 12.0.0a0.

  • Openstack nova: vnc proxy can connect to the wrong vm

    Affected: fixed in 12.0.0a0.

  • CVE-2012-5625Medium 6.5

    Openstack nova: information leak in libvirt lvm-backed instances

    Affected: fixed in 12.0.0a0; version range not reported.

  • virt/disk/api.py in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to…

    Affected: fixed in 12.0.0; all versions.

  • OpenStack Compute (Nova) Essex before 2011.3 allows remote authenticated users to cause a denial of service (Nova-API log file and disk…

    Affected: fixed in 12.0.0a0.

  • virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) allows remote authenticated users to…

    Affected: fixed in 12.0.0a0.

  • Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over…

    Affected: fixed in 12.0.0a0.

  • The Nova scheduler in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when DifferentHostFilter or SameHostFilter is enabled…

    Affected: fixed in 12.0.0a0.

  • The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the…

    Affected: fixed in 12.0.0a0.

  • Openstack Compute (Nova) Folsom, 2012.1, and 2011.3 does not limit the number of security group rules, which allows remote authenticated…

    Affected: fixed in 12.0.0a0.

  • Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage…

    Affected: fixed in 12.0.0a0.