RHEL 6 : openstack-nova (RHSA-2014:0112)

high Nessus Plugin ID 234390

Language:

Synopsis

The remote Red Hat host is missing one or more security updates for openstack-nova.

Description

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2014:0112 advisory.

The openstack-nova packages provide OpenStack Compute (nova), which provides services for provisioning, managing, and using virtual machine instances.

It was discovered that enabling qpid_protocol = ssl in the nova.conf file did not result in nova using SSL to communicate to Qpid. If Qpid was not configured to enforce SSL this could lead to sensitive information being sent unencrypted over the communication channel. (CVE-2013-6491)

A flaw was found in the way OpenStack Compute controlled the size of disk images. An authenticated remote user could use malicious compressed qcow2 disk images to consume large amounts of disk space, potentially causing a denial of service on the OpenStack Compute nodes. (CVE-2013-4463)

Red Hat would like to thank the OpenStack project for reporting CVE-2013-4463. Upstream acknowledges Bernhard M. Wiedemann of SuSE as the original reporter of this issue.

This update also fixes the following bugs:

* When using GroupAntiAffinityFilter, the scheduler was not filtering instances in the group, which could cause an instance to not be scheduled at all if a group was specified on boot. With this fix, groups are taken into account and the instance is scheduled as expected. (BZ#1014948)

* If an exchange had not been created previously by a consumer, the publisher would crash because it could not find the specified exchange.
This resulted from Qpid's direct publisher using the wrong exchange type 'Direct'. With this fix, the exchange type in the publisher has been changed to 'direct'. (BZ#1042055)

* Unhandled errors in the Qpid consuming thread could kill it silently and isolate the component from the rest of the system. To fix this, the consuming thread has been made more resilient to errors by ensuring it does not die on an unhandled error. Compute now logs the error and retries the consuming thread. (BZ#1050213)

All openstack-nova users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the RHEL openstack-nova package based on the guidance in RHSA-2014:0112.

Plugin Details

Severity: High

ID: 234390

File Name: redhat-RHSA-2014-0112.nasl

Version: 1.1

Type: local

Agent: unix

Family: Red Hat Local Security Checks

Published: 4/15/2025

Updated: 4/15/2025

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3.6

Vendor

Vendor Severity: Moderate

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2013-6491

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2013-4463

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:openstack-nova-common, p-cpe:/a:redhat:enterprise_linux:openstack-nova-compute, p-cpe:/a:redhat:enterprise_linux:openstack-nova-cells, cpe:/o:redhat:enterprise_linux:6, p-cpe:/a:redhat:enterprise_linux:openstack-nova-scheduler, p-cpe:/a:redhat:enterprise_linux:openstack-nova-objectstore, p-cpe:/a:redhat:enterprise_linux:openstack-nova, p-cpe:/a:redhat:enterprise_linux:openstack-nova-network, p-cpe:/a:redhat:enterprise_linux:python-nova, p-cpe:/a:redhat:enterprise_linux:openstack-nova-conductor, p-cpe:/a:redhat:enterprise_linux:openstack-nova-api, p-cpe:/a:redhat:enterprise_linux:openstack-nova-console, p-cpe:/a:redhat:enterprise_linux:openstack-nova-cert, p-cpe:/a:redhat:enterprise_linux:openstack-nova-doc

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 1/30/2014

Vulnerability Publication Date: 10/31/2013

Reference Information

CVE: CVE-2013-4463, CVE-2013-6491

RHSA: 2014:0112

Detections

Analytics