CVE-2012-2654
- State
- Published
- Severity
- Not scored
- Published
- Jun 21, 2012
- Updated
- Aug 6, 2024
- Reserved
- May 14, 2012
Description
The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 46808third-party-advisory
- https://review.openstack.org/#/c/8239/
- https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09beac2978
- https://bugs.launchpad.net/nova/+bug/985184
- https://github.com/openstack/nova/commit/ff06c7c885dc94ed7c828e8cdbb8b5d850a7e654
- USN-1466-1vendor-advisory
- [openstack] 20120606 [OSSA 2012-007] Security groups fail to be set correctly (CVE-2012-2654)mailing-list
- nova-security-group-sec-bypass(76110)vdb-entry
- 49439third-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.