1. Ubuntu Security Notices
  2. USN-5866-1

USN-5866-1: Nova vulnerabilities

Publication date

13 February 2023

Overview

Several security issues were fixed in Nova.

Releases

Packages

  • nova - OpenStack Compute cloud infrastructure

Details

It was discovered that Nova did not properly manage data logged into the
log file. An attacker with read access to the service’s logs could exploit
this issue and may obtain sensitive information. This issue only affected
Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2015-9543)

It was discovered that Nova did not properly handle attaching and
reattaching the encrypted volume. An attacker could possibly use this issue
to perform a denial of service attack. This issue only affected Ubuntu
16.04 ESM. (CVE-2017-18191)

It was discovered that Nova did not properly handle the updation of domain
XML after live migration. An attacker could possibly use this issue to
corrupt the volume or perform a denial of service attack. This issue only
affected Ubuntu 18.04 LTS. (CVE-2020-17376)

It was discovered that Nova was not...

It was discovered that Nova did not properly manage data logged into the
log file. An attacker with read access to the service’s logs could exploit
this issue and may obtain sensitive information. This issue only affected
Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2015-9543)

It was discovered that Nova did not properly handle attaching and
reattaching the encrypted volume. An attacker could possibly use this issue
to perform a denial of service attack. This issue only affected Ubuntu
16.04 ESM. (CVE-2017-18191)

It was discovered that Nova did not properly handle the updation of domain
XML after live migration. An attacker could possibly use this issue to
corrupt the volume or perform a denial of service attack. This issue only
affected Ubuntu 18.04 LTS. (CVE-2020-17376)

It was discovered that Nova was not properly validating the URL passed to
noVNC. An attacker could possibly use this issue by providing malicious URL
to the noVNC proxy to redirect to any desired URL. This issue only affected
Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2021-3654)

It was discovered that Nova did not properly handle changes in the neutron
port of vnic_type type. An authenticated user could possibly use this issue
to perform a denial of service attack. This issue only affected Ubuntu
20.04 LTS. (CVE-2022-37394)

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
20.04 focal nova-common –  2:21.2.4-0ubuntu2.2
python3-nova –  2:21.2.4-0ubuntu2.2
18.04 bionic nova-common –  2:17.0.13-0ubuntu5.3
python-nova –  2:17.0.13-0ubuntu5.3
16.04 xenial nova-common –  2:13.1.4-0ubuntu4.5+esm1  
python-nova –  2:13.1.4-0ubuntu4.5+esm1  

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›