CVE-2020-17376

An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source host. This can include block devices that map to different Cinder volumes at the destination than at the source. Only deployments allowing host-based connections (for instance, root and ephemeral devices) are affected.

• CWE-611

• http://www.openwall.com/lists/oss-security/2020/08/25/4Mailing List, Patch, Third Party Advisory
• https://launchpad.net/bugs/1890501Exploit, Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2020-006.htmlPatch, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2020/08/25/4Mailing List, Patch, Third Party Advisory
• https://launchpad.net/bugs/1890501Exploit, Third Party Advisory
• https://security.openstack.org/ossa/OSSA-2020-006.htmlPatch, Vendor Advisory

Published

Aug 26, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-17366An issue was discovered in NLnet Labs Routinator 0.1.0 throu…7.4
• CVE-2020-17367Firejail through 0.9.62 does not honor the -- end-of-options…7.8
• CVE-2020-17368Firejail through 0.9.62 mishandles shell metacharacters duri…9.8
• CVE-2020-1737A flaw was found in Ansible 2.7.17 and prior, 2.8.9 and prio…7.8
• CVE-2020-17372SugarCRM before 10.1.0 (Q3 2020) allows XSS.5.4
• CVE-2020-17373SugarCRM before 10.1.0 (Q3 2020) allows SQL Injection.5.3
• CVE-2020-1738A flaw was found in Ansible Engine when the module package o…3.9
• CVE-2020-17380A heap-based buffer overflow was found in QEMU through 5.0.0…6.3
• CVE-2020-17381An issue was discovered in Ghisler Total Commander 9.51. Due…7.3
• CVE-2020-17382The MSI AmbientLink MsIo64 driver 1.0.0.8 has a Buffer Overf…7.8
• CVE-2020-17383A directory traversal vulnerability on Telos Z/IP One device…9.8
• CVE-2020-17384Cellopoint CelloOS v4.1.10 Build 20190922 does not validate …7.2