CVE-2017-16239
Last modified
CVE-2017-16239 is a vulnerability of currently unknown severity. In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. EPSS estimates a 1.41% chance of exploitation in the next 30 days.
Description
In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Because of the regression described in Launchpad Bug #1732947, the preferred fix is a 14.x version after 14.0.10, a 15.x version after 15.0.8, or a 16.x version after 16.0.3.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Openstack | Nova | <= 14.0.9 |
| Openstack | Nova | 15.0.0 |
| Openstack | Nova | 15.0.1 |
| Openstack | Nova | 15.0.2 |
| Openstack | Nova | 15.0.3 |
| Openstack | Nova | 15.0.4 |
| Openstack | Nova | 15.0.5 |
| Openstack | Nova | 15.0.6 |
| Openstack | Nova | 15.0.7 |
| Openstack | Nova | 16.0.0 |
| Openstack | Nova | 16.0.1 |
| Openstack | Nova | 16.0.2 |
References
- http://www.securityfocus.com/bid/101950Third Party Advisory, VDB Entry
- https://launchpad.net/bugs/1664931Issue Tracking
- https://security.openstack.org/ossa/OSSA-2017-005.htmlVendor Advisory
- http://www.securityfocus.com/bid/101950Third Party Advisory, VDB Entry
- https://launchpad.net/bugs/1664931Issue Tracking
- https://security.openstack.org/ossa/OSSA-2017-005.htmlVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-16239?
How severe is CVE-2017-16239?
How do I fix CVE-2017-16239?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-16229In the Ox gem 2.8.1 for Ruby, the process crashes with a sta…
- CVE-2017-1623IBM QRadar 7.2 and 7.3 is vulnerable to cross-site scripting…
- CVE-2017-16230In admin/write-post.php in Typecho through 1.1, one can log …
- CVE-2017-16231In PCRE 8.41, after compiling, a pcretest load test PoC prod…5.5
- CVE-2017-16232LibTIFF 4.0.8 has multiple memory leak vulnerabilities, whic…
- CVE-2017-16237In Vir.IT eXplorer Anti-Virus before 8.5.42, the driver file…
- CVE-2017-1624IBM QRadar 7.3 and 7.3.1 specifies permissions for a securit…4.2
- CVE-2017-16241Incorrect access control in AMAG Symmetry Door Edge Network …
- CVE-2017-16242An issue was discovered on MECO USB Memory Stick with Finger…
- CVE-2017-16244Cross-Site Request Forgery exists in OctoberCMS 1.0.426 (aka…
- CVE-2017-16248The Catalyst-Plugin-Static-Simple module before 0.34 for Per…
- CVE-2017-16249The Debut embedded http server contains a remotely exploitab…
Are you affected by CVE-2017-16239?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST