CVE-2014-3517

Publication date 7 August 2014

Last updated 24 July 2024

Ubuntu priority

api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying metadata requests through Neutron, makes it easier for remote attackers to guess instance ID signatures via a brute-force attack that relies on timing differences in responses to instance metadata requests.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
nova	14.04 LTS trusty	Fixed 1:2014.1.2-0ubuntu1
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Not in release

Notes

jdstrand

per upstream, Only setups configured to proxy metadata requests via Neutron are affected

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
nova	Upstream: https://review.openstack.org/107396 Upstream: https://review.openstack.org/#/c/107397/

References

Related Ubuntu Security Notices (USN)