OpenStack Nova Arbitrary file injection/corruption through directory traversal issues

published 2012-07-22 14 y ago modified 2026-06-16 4 mo ago also GHSA-cm54-3vvf-f5p8 , PYSEC-2012-39 , EUVD-2012-0022

cvss: 5.5; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 2.7%; EPSS 2.7% chance of exploitation in 30 days, percentile 85%
public exploits: 0; none known

virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image.

Patch / fix

fixed in 1 distros 1 links 2

pypi nova 12.0.0a0

nova Debian 14, Debian 13, Debian 12 2012.1.1-2

debian advisories DEBIAN-CVE-2012-3361

github.com/openstack/nova@2427d4a commit
github.com/openstack/nova@b0feaff commit

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2012-3361 updated 2025-11-21 cvss 3.5

OpenStack-Nova: compute nodes disk image file corruption

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.65% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

github.com https://github.com/openstack/nova/commit/2427d4a99bed35baefd8f17ba422cb7aae8dcca7 referenced PoC, tagged "exploit" by a source, unverified
github.com https://github.com/openstack/nova/commit/b0feaffdb2b1c51182b8dce41b367f3449af5dd9 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	5.5	AV:N/AC:L/Au:S/C:N/I:P/A:P

Affected packages

ecosystem	package	affected	fixed in
pypi	nova	<12.0.0a0	12.0.0a0

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls

References

github.com /openstack/nova/commit/2427d4a99bed35baefd8f17ba422cb7aae8dcca7
web, exploit, patch, evidence
github.com /openstack/nova/commit/b0feaffdb2b1c51182b8dce41b367f3449af5dd9
web, exploit, patch, evidence
lists.fedoraproject.org /pipermail/package-announce/2012-July/083969.html
vendor-advisory, web
lists.fedoraproject.org /pipermail/package-announce/2012-July/083984.html
vendor-advisory, web
ubuntu.com /usn/USN-1497-1
vendor-advisory, web, advisory
secunia.com /advisories/49763
third-party-advisory, vendor-advisory, advisory
secunia.com /advisories/49802
third-party-advisory, vendor-advisory, advisory
review.openstack.org /#/c/9268/
web
securityfocus.com /bid/54278
vdb-entry, web
bugs.launchpad.net /nova/+bug/1015531
web
lists.launchpad.net /openstack/msg14089.html
mailing-list, web
nvd.nist.gov /vuln/detail/CVE-2012-3361
advisory
github.com /openstack/nova
package
github.com /pypa/advisory-database/tree/main/vulns/nova/PYSEC-2012-39.yaml
web
review.openstack.org /#/c/9268
web
github.com /advisories/GHSA-cm54-3vvf-f5p8
advisory

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary