affected:
- package:
    ecosystem: PyPI
    name: nova
    purl: pkg:pypi/nova
  ranges:
  - events:
    - introduced: '0'
    type: ECOSYSTEM
  versions:
  - 15.1.5
  - 16.1.6
  - 16.1.7
  - 16.1.8
  - 17.0.10
  - 17.0.11
  - 17.0.12
  - 17.0.13
  - 17.0.7
  - 17.0.8
  - 17.0.9
  - 18.0.2
  - 18.0.3
  - 18.1.0
  - 18.2.0
  - 18.2.1
  - 18.2.2
  - 18.2.3
  - 18.3.0
  - 19.0.0
  - 19.0.0.0rc1
  - 19.0.0.0rc2
  - 19.0.1
  - 19.0.2
  - 19.0.3
  - 19.1.0
  - 19.2.0
  - 19.3.0
  - 19.3.1
  - 19.3.2
  - 20.0.0
  - 20.0.0.0rc1
  - 20.0.0.0rc2
  - 20.0.1
  - 20.1.0
  - 20.1.1
  - 20.2.0
  - 20.3.0
  - 20.4.0
  - 20.4.1
  - 20.5.0
  - 20.6.0
  - 20.6.1
  - 21.0.0
  - 21.0.0.0rc1
  - 21.0.0.0rc2
  - 21.1.0
  - 21.1.1
  - 21.1.2
  - 21.2.0
  - 21.2.1
  - 21.2.2
  - 21.2.3
  - 21.2.4
  - 22.0.0
  - 22.0.0.0rc1
  - 22.0.1
  - 22.1.0
  - 22.2.0
  - 22.2.1
  - 22.2.2
  - 22.3.0
  - 22.4.0
  - 23.0.0
  - 23.0.0.0rc1
  - 23.0.0.0rc2
  - 23.0.1
  - 23.0.2
  - 23.1.0
  - 23.2.0
  - 23.2.1
  - 23.2.2
  - 24.0.0
  - 24.0.0.0rc1
  - 24.0.0.0rc2
  - 24.1.0
  - 24.1.1
  - 24.2.0
  - 24.2.1
  - 25.0.0
  - 25.0.0.0rc1
  - 25.0.1
  - 25.1.0
  - 25.1.1
  - 25.2.0
  - 25.2.1
  - 25.3.0
  - 26.0.0
  - 26.0.0.0rc1
  - 26.0.0.0rc2
  - 26.1.0
  - 26.1.1
  - 26.2.0
  - 26.2.1
  - 26.2.2
  - 26.3.0
  - 27.0.0
  - 27.0.0.0rc1
  - 27.1.0
  - 27.2.0
  - 27.3.0
  - 27.4.0
  - 27.5.0
  - 27.5.1
  - 28.0.0
  - 28.0.0.0rc1
  - 28.0.1
  - 28.1.0
  - 28.2.0
  - 28.3.0
  - 29.0.0
  - 29.0.0.0rc1
  - 29.0.1
  - 29.0.2
  - 29.1.0
  - 29.2.0
  - 30.0.0
  - 30.0.0.0rc1
aliases:
- CVE-2013-2030
details: keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and
  Havana uses an insecure temporary directory for storing signing certificates, which
  allows local users to spoof servers by pre-creating this directory, which is reused
  by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.
id: PYSEC-2013-45
modified: '2024-11-21T14:22:56.793365Z'
published: '2013-12-27T01:55:00Z'
references:
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2013/05/09/2
- type: FIX
  url: http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.html
- type: ADVISORY
  url: http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.html
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=958285
- type: WEB
  url: https://bugs.launchpad.net/nova/+bug/1174608
- type: WEB
  url: http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html
withdrawn: '2024-11-22T04:37:04Z'