CVE-2012-2101
CVE-2012-2101 is a low-severity vulnerability in Openstack Nova with a CVSS 2.0 base score of 3.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-264.
Key facts
- Severity: Low (CVSS 2.0 base score 3.5)
- EPSS exploit prediction: 1% (71st percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-264
- Affected product: Openstack Nova
- Published:
- Last modified:
Description
Openstack Compute (Nova) Folsom, 2012.1, and 2011.3 does not limit the number of security group rules, which allows remote authenticated users with certain permissions to cause a denial of service (CPU and hard drive consumption) via a network request that triggers a large number of iptables rules.
Frequently asked questions
- What is CVE-2012-2101?
- Openstack Compute (Nova) Folsom, 2012.1, and 2011.3 does not limit the number of security group rules, which allows remote authenticated users with certain permissions to cause a denial of service (CPU and hard drive consumption) via a network request that triggers a large number of iptables rules.
- How severe is CVE-2012-2101?
- CVE-2012-2101 has a CVSS 2.0 base score of 3.5, rated low severity.
- Is CVE-2012-2101 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (71st percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2012-2101?
- CVE-2012-2101 primarily affects Openstack Nova. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2012-2101?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2012-2101 published?
- CVE-2012-2101 was published on 2012-06-07 and last updated on 2026-06-16.
References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079434.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-May/079551.html
- http://secunia.com/advisories/49034
- http://secunia.com/advisories/49048
- http://ubuntu.com/usn/usn-1438-1
- http://www.osvdb.org/81641
- https://bugs.launchpad.net/nova/+bug/969545
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75243
- https://github.com/openstack/nova/commit/1f644d210557b1254f7c7b39424b09a45329ade7
- https://github.com/openstack/nova/commit/8c8735a73afb16d5856f0aa6088e9ae406c52beb
- https://github.com/openstack/nova/commit/a67db4586f70ed881d65e80035b2a25be195ce64
- https://lists.launchpad.net/openstack/msg10268.html
Affected products (3)
- cpe:2.3:a:openstack:nova:2011.3:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:nova:2012.1:*:*:*:*:*:*:*
- cpe:2.3:a:openstack:nova:folsom:*:*:*:*:*:*:*
More vulnerabilities in Openstack Nova
- CVE-2017-7214 — Critical (CVSS 9.8): An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x…
- CVE-2011-3147 — High (CVSS 8.6): Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a…
- CVE-2017-17051 — High (CVSS 8.6): An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance…
- CVE-2020-17376 — High (CVSS 8.3): An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1,…
- CVE-2017-18191 — High (CVSS 7.5): An issue was discovered in OpenStack Nova 15.x through 15.1.0 and 16.x through 16.1.1. By detaching and reattaching an…
- CVE-2015-5162 — High (CVSS 7.5): The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before…
All CVEs affecting Openstack Nova →
Other CWE-264 (Permissions, Privileges, and Access Controls) vulnerabilities
- CVE-2016-8363 — Critical (CVSS 10.0): An issue was discovered in Moxa OnCell OnCellG3470A-LTE, AWK-1131A/3131A/4131A Series, AWK-3191 Series, AWK-5232/6232…
- CVE-2016-7457 — Critical (CVSS 10.0): VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to gain privileges, or halt…
- CVE-2015-7425 — Critical (CVSS 10.0): The Data Protection component in the VMware vSphere GUI in IBM Tivoli Storage Manager for Virtual Environments: Data…
- CVE-2015-8267 — Critical (CVSS 10.0): The PasswordReset.Controllers.ResetController.ChangePasswordIndex method in PasswordReset.dll in Dovestones AD Self…
- CVE-2015-7919 — Critical (CVSS 10.0): SearchBlox 8.3 before 8.3.1 allows remote attackers to write to the config file, and consequently cause a denial of…
- CVE-2015-7071 — Critical (CVSS 10.0): The File Bookmark component in Apple OS X before 10.11.2 allows attackers to bypass a sandbox protection mechanism for…
Browse all CWE-264 (Permissions, Privileges, and Access Controls) vulnerabilities →