Skip to content
Fencer Intel
medium 6.5

CVE-2017-16239 json

OpenStack Nova Filter Scheduler Bypass

published 2017-11-14 8 y ago modified 2026-07-06 4 mo ago also GHSA-w2wf-cgwh-vpqg , PYSEC-2026-694 , EUVD-2022-5467

cvss
6.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 73%
public exploits
0
none known

Summary

In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Because of the regression described in Launchpad Bug #1732947, the preferred fix is a 14.x version after 14.0.10, a 15.x version after 15.0.8, or a 16.x version after 16.0.3.

Patch / fix

  • pypi nova 14.0.10, 15.0.8, 16.0.3
  • nova Debian 14, Debian 13, Debian 12 2:16.0.3-1

debian advisories DEBIAN-CVE-2017-16239

  • openstack-nova openstack 12 1:16.0.2-9.el7ost
  • python-nova openstack 12 1:16.0.2-9.el7ost
  • python-nova-tests openstack 12 1:16.0.2-9.el7ost
  • openstack-nova-api openstack 12 1:16.0.2-9.el7ost
  • openstack-nova-cells openstack 12 1:16.0.2-9.el7ost
  • openstack-nova-common openstack 12 1:16.0.2-9.el7ost
  • openstack-nova-compute openstack 12 1:16.0.2-9.el7ost
  • openstack-nova-console openstack 12 1:16.0.2-9.el7ost

red hat advisories RHSA-2018:0241RHSA-2018:0369RHSA-2018:0314

  • openstack-nova OpenStack Cloud 7 14.0.10~dev13-4.11.1

suse advisories SUSE-SU-2017:3080-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-16239 updated cvss 5.4

openstack-nova: Nova Filter Scheduler bypass through rebuild action

  • Red Hat Enterprise Linux OpenStack Platform 6 (Juno) openstack-nova Red Hat Enterprise Linux OpenStack Platform 7 (Kilo) python-nova, openstack-nova, openstack-nova-api, openstack-nova-cert, openstack-nova-cells, openstack-nova-common, +9 more Red Hat OpenStack Platform 8 (Liberty) python-nova, openstack-nova, openstack-nova-api, openstack-nova-cert, openstack-nova-cells, openstack-nova-common, +9 more Red Hat OpenStack Platform 9 (Mitaka) python-nova, openstack-nova, python-nova-tests, openstack-nova-api, openstack-nova-cert, openstack-nova-cells, +10 more
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack 10.0 Tools for RHEL 7 python-novaclient 6.0.2-2.el7ost Red Hat OpenStack Platform 10.0 python-nova 14.1.0-3.el7ost, openstack-nova 14.1.0-3.el7ost, python-novaclient 6.0.2-2.el7ost, python-nova-tests 14.1.0-3.el7ost, openstack-nova-api 14.1.0-3.el7ost, openstack-nova-cert 14.1.0-3.el7ost, +12 more
    fixed: vendor fix RHSA-2018:0369
  • Red Hat OpenStack Platform 11.0 python-nova 15.0.8-5.el7ost, openstack-nova 15.0.8-5.el7ost, python-nova-tests 15.0.8-5.el7ost, openstack-nova-api 15.0.8-5.el7ost, openstack-nova-cert 15.0.8-5.el7ost, openstack-nova-cells 15.0.8-5.el7ost, +11 more
    fixed: vendor fix RHSA-2018:0314
  • Red Hat OpenStack Platform 12.0 python-nova 16.0.2-9.el7ost, openstack-nova 16.0.2-9.el7ost, python-nova-tests 16.0.2-9.el7ost, openstack-nova-api 16.0.2-9.el7ost, openstack-nova-cells 16.0.2-9.el7ost, openstack-nova-common 16.0.2-9.el7ost, +10 more
    fixed: vendor fix RHSA-2018:0241

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.42% chance of exploitation in the next 30 days, higher than 73% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N
OSV 3.0 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
GitHub 3.0 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
pypi nova
>=16.0.0, <16.0.3
>=15.0.0, <15.0.8
>=14.0.0, <14.0.10
16.0.3
15.0.8
14.0.10

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.