Skip to content
Fencer Intel
medium 5.0

CVE-2015-7713 json

OpenStack Compute (Nova) allows remote attackers to bypass intended restriction

published 2015-10-29 11 y ago modified 2026-09-10 1 mo ago also GHSA-67rh-9p29-vrxr , PYSEC-2026-867 , EUVD-2022-2743

cvss
5.0
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
3.7%
EPSS 3.7% chance of exploitation in 30 days, percentile 89%
public exploits
0
none known

Summary

OpenStack Compute (Nova) before 2014.2.4 (juno) and 2015.1.x before 2015.1.2 (kilo) do not properly apply security group changes, which allows remote attackers to bypass intended restriction by leveraging an instance that was running when the change was made.

Patch / fix

  • pypi nova 2014.2.4, 2015.1.2
  • openstack nova 2014.2.4, 2015.1.2
  • nova Debian 14, Debian 13, Debian 12 1:12.0.0-2

debian advisories DEBIAN-CVE-2015-7713

  • nova Ubuntu 14.04 LTS 1:2014.1.5-0ubuntu1.7

ubuntu advisories UBUNTU-CVE-2015-7713

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • openstack-nova openstack 7 2015.1.2-7.el7ost
  • python-nova openstack 7 2015.1.2-7.el7ost
  • python-novaclient openstack 7 1:2.23.0-2.el7ost
  • openstack-nova-api openstack 7 2015.1.2-7.el7ost
  • openstack-nova-cert openstack 7 2015.1.2-7.el7ost
  • openstack-nova-cells openstack 7 2015.1.2-7.el7ost
  • openstack-nova-common openstack 7 2015.1.2-7.el7ost
  • openstack-nova-compute openstack 7 2015.1.2-7.el7ost

red hat advisories RHSA-2015:2673RHSA-2016:0017RHSA-2016:0013RHSA-2015:2684

  • openstack-nova Cloud Compute Node for SUSE Linux Enterprise 12 5 2014.2.4~a0~dev80-14.1
  • openstack-neutron Cloud Compute Node for SUSE Linux Enterprise 12 5 2014.2.4~a0~dev103-10.3
  • python-python-memcached Cloud Compute Node for SUSE Linux Enterprise 12 5 1.54-2.1
  • openstack-nova OpenStack Cloud 5 2014.2.4~a0~dev80-20.1

suse advisories SUSE-SU-2015:2220-1SUSE-SU-2015:2219-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2015-7713 updated cvss 5.5

openstack-nova: network security group changes are not applied to running instances

  • Red Hat OpenStack 7.0 Tools for RHEL 7 python-novaclient 2.23.0-2.el7ost
    fixed: vendor fix RHSA-2015:2673
  • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 python-nova 2014.1.5-16.el6ost, openstack-nova 2014.1.5-16.el6ost, openstack-nova-api 2014.1.5-16.el6ost, openstack-nova-cert 2014.1.5-16.el6ost, openstack-nova-cells 2014.1.5-16.el6ost, openstack-nova-common 2014.1.5-16.el6ost, +8 more
    fixed: vendor fix RHSA-2016:0017
  • Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 python-nova 2014.1.5-9.el7ost, openstack-nova 2014.1.5-9.el7ost, openstack-nova-api 2014.1.5-9.el7ost, openstack-nova-cert 2014.1.5-9.el7ost, openstack-nova-cells 2014.1.5-9.el7ost, openstack-nova-common 2014.1.5-9.el7ost, +8 more
    fixed: vendor fix RHSA-2015:2684
  • Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 python-nova 2014.2.3-42.el7ost, openstack-nova 2014.2.3-42.el7ost, openstack-nova-api 2014.2.3-42.el7ost, openstack-nova-cert 2014.2.3-42.el7ost, openstack-nova-cells 2014.2.3-42.el7ost, openstack-nova-common 2014.2.3-42.el7ost, +8 more
    fixed: vendor fix RHSA-2016:0013
  • Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 python-nova 2015.1.2-7.el7ost, openstack-nova 2015.1.2-7.el7ost, python-novaclient 2.23.0-2.el7ost, openstack-nova-api 2015.1.2-7.el7ost, openstack-nova-cert 2015.1.2-7.el7ost, openstack-nova-cells 2015.1.2-7.el7ost, +10 more
    fixed: vendor fix RHSA-2015:2673

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.70% chance of exploitation in the next 30 days, higher than 89% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:N/I:P/A:N

Affected packages

ecosystem package affected fixed in
pypi nova
<2014.2.4
>=2015.1.0, <2015.1.2
2014.2.4
2015.1.2

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.