CVE-2014-3517

api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying metadata requests through Neutron, makes it easier for remote attackers to guess instance ID signatures via a brute-force attack that relies on timing differences in responses to instance metadata requests.

• CWE-200

• http://www.openwall.com/lists/oss-security/2014/07/17/2Patch, Third Party Advisory
• https://bugs.launchpad.net/nova/+bug/1325128Third Party Advisory
• http://www.openwall.com/lists/oss-security/2014/07/17/2Patch, Third Party Advisory
• https://bugs.launchpad.net/nova/+bug/1325128Third Party Advisory

Published

Aug 7, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-3511The ssl23_get_client_hello function in s23_srvr.c in OpenSSL…
• CVE-2014-3512Multiple buffer overflows in crypto/srp/srp_lib.c in the SRP…
• CVE-2014-3513Memory leak in d1_srtp.c in the DTLS SRTP extension in OpenS…
• CVE-2014-3514activerecord/lib/active_record/relation/query_methods.rb in …
• CVE-2014-3515The SPL component in PHP before 5.4.30 and 5.5.x before 5.5.…
• CVE-2014-3516Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2014-3518jmx-remoting.sar in JBoss Remoting, as used in Red Hat JBoss…
• CVE-2014-3519The open_by_handle_at function in vzkernel before 042stab090…
• CVE-2014-3520OpenStack Identity (Keystone) before 2013.2.4, 2014.x before…
• CVE-2014-3521The component in (1) /luci/homebase and (2) /luci/cluster me…
• CVE-2014-3522The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x b…
• CVE-2014-3523Memory leak in the winnt_accept function in server/mpm/winnt…