Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite arbitrary files via a crafted (1) tarball or (2) manifest.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Multiple directory traversal vulnerabilities in OpenStack Nova before 2011.3.1, when the EC2 API and the
    S3/RegisterImage image-registration method are enabled, allow remote authenticated users to overwrite
    arbitrary files via a crafted (1) tarball or (2) manifest. (CVE-2011-4596)

Update to 2011.3.1 release candidate. See https://launchpad.net/nova/+milestone/2011.3.1

This also includes a minor bug fix for libguestfs file injection

This update includes ~50 patches from the upstream stable branch and a fix for an issue with attaching volumes.

Sync up with Fedora spec, to only add fuse group if present.
Explicitly depend on the fuse package to avoid #767852. Requires manually installing 'fuse' first.

Also adds libguestfs update

Add --yes, --rootpw, and --novapw arguments to openstack-nova-db-setup.

Please ensure you have at least python-migrate-0.6-6 installed when testing this

Change the default database from sqlite to mysql.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Also updates the libguestfs suppose Add --yes, --rootpw, and --novapw options to openstack-db-setup. Change the default database from sqlite to mysql.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

David Black discovered that Nova did not properly perform input validation during image registration. An attacker could exploit this by registering a crafted image using the EC2 API or S3/RegisterImage method and overwrite files as the nova user.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
432764	SCA: security update for nova (GHSA-qr62-r9xc-r2gj)	Tenable Cloud Security	SCA Checks	Local	high
432764	SCA: security update for nova (GHSA-qr62-r9xc-r2gj)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
57610	Fedora 16 : openstack-nova-2011.3.1-0.4.10818.fc16 (2012-0682)	Nessus	Fedora Local Security Checks	Local	medium
57387	Fedora 16 : openstack-nova-2011.3-13.fc16 (2011-17111)	Nessus	Fedora Local Security Checks	Local	medium
57306	Ubuntu 11.10 : nova vulnerability (USN-1305-1)	Nessus	Ubuntu Local Security Checks	Local	medium

Detections

Analytics

CVE-2011-4596

high

Tenable Plugins

high

high

medium

medium

medium