affected:
- package:
    ecosystem: PyPI
    name: nova
    purl: pkg:pypi/nova
  ranges:
  - events:
    - introduced: '0'
    - fixed: 12.0.0a0
    type: ECOSYSTEM
aliases:
- CVE-2013-7130
- GHSA-99rx-9x8v-9j8p
details: The i_create_images_and_backing (aka create_images_and_backing) method in
  libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using
  KVM live block migration, does not properly create all expected files, which allows
  attackers to obtain snapshot root disk contents of other users via ephemeral storage.
id: PYSEC-2014-111
modified: '2024-11-25T18:35:18.357593Z'
published: '2014-02-06T17:00:00Z'
references:
- type: WEB
  url: http://osvdb.org/102416
- type: FIX
  url: https://review.openstack.org/#/c/68658/
- type: WEB
  url: http://www.securityfocus.com/bid/65106
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2014/01/23/5
- type: WEB
  url: https://review.openstack.org/#/c/68659/
- type: ADVISORY
  url: http://secunia.com/advisories/56450
- type: WEB
  url: https://bugs.launchpad.net/nova/+bug/1251590
- type: FIX
  url: https://review.openstack.org/#/c/68660/
- type: WEB
  url: http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.html
- type: WEB
  url: http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127735.html
- type: ADVISORY
  url: http://rhn.redhat.com/errata/RHSA-2014-0231.html
- type: ADVISORY
  url: http://www.ubuntu.com/usn/USN-2247-1
- type: WEB
  url: https://exchange.xforce.ibmcloud.com/vulnerabilities/90652