CVE-2013-0335

Publication date 26 February 2013

Last updated 24 July 2024

OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC token for a deleted VM that was bound to the same VNC port.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
nova	12.10 quantal	Fixed 2012.2.1+stable-20121212-a99a802e-0ubuntu1.4
	12.04 LTS precise	Fixed 2012.1.3+stable-20120827-4d2a4afe-0ubuntu1.4
	11.10 oneiric	Ignored
	10.04 LTS lucid	Not in release
	8.04 LTS hardy	Not in release

Notes

jdstrand

on 11.10, VNC consoles are only available via the web interface, but the web interface (horizon) is not functional since it depends on keystone and the keystone in 11.10 is a pre-release version and unusable with other components like horizon and nova.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
nova	Upstream: https://review.openstack.org/#/c/22086/ Upstream: https://review.openstack.org/#/c/22758 Upstream: https://review.openstack.org/#/c/22872/ Upstream: https://review.openstack.org/#/c/23036/

CVE-2013-0335

Status

Notes

jdstrand

Patch details

References

Related Ubuntu Security Notices (USN)

Other references