CVE-2017-18191

An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an encrypted volume, an attacker may access the underlying raw volume and corrupt the LUKS header, resulting in a denial of service attack on the compute host. (The same code error also results in data loss, but that is not a vulnerability because the user loses their own data.) All Nova setups supporting encrypted volumes are affected.

• http://openwall.com/lists/oss-security/2018/04/20/3Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/103104Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:2332Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2714Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2855Third Party Advisory
• https://launchpad.net/bugs/1739593Exploit, Issue Tracking, Third Party Advisory
• https://review.openstack.org/539893Exploit, Patch, Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2018-001.htmlPatch, Vendor Advisory
• http://openwall.com/lists/oss-security/2018/04/20/3Mailing List, Patch, Third Party Advisory
• http://www.securityfocus.com/bid/103104Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2018:2332Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2714Third Party Advisory
• https://access.redhat.com/errata/RHSA-2018:2855Third Party Advisory
• https://launchpad.net/bugs/1739593Exploit, Issue Tracking, Third Party Advisory
• https://review.openstack.org/539893Exploit, Patch, Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2018-001.htmlPatch, Vendor Advisory

Published

Feb 19, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-18186An issue was discovered in QPDF before 7.0.0. There is an in…
• CVE-2017-18187In ARM mbed TLS before 2.7.0, there is a bounds-check bypass…
• CVE-2017-18188OpenRC opentmpfiles through 0.1.3, when the fs.protected_har…
• CVE-2017-18189In the startread function in xa.c in Sound eXchange (SoX) th…
• CVE-2017-1819Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-18190A localhost.localdomain whitelist entry in valid_host() in s…
• CVE-2017-18192smart/calculator/gallerylock/CalculatorActivity.java in the …
• CVE-2017-18193fs/f2fs/extent_cache.c in the Linux kernel before 4.13 misha…
• CVE-2017-18194SQL injection vulnerability in users/signup.php in the "sign…
• CVE-2017-18195An issue was discovered in tools/conversations/view_ajax.php…5.3
• CVE-2017-18196Leptonica 1.74.4 constructs unintended pathnames (containing…
• CVE-2017-18197In mxGraphViewImageReader.java in mxGraph before 3.7.6, the …