CVE-2012-3360
OpenStack Nova Directory traversal vulnerability
EPSS 1.4%
Description
Directory traversal vulnerability in virt/disk/api.py in OpenStack Compute (Nova) Folsom (2012.2) and Essex (2012.1), when used over libvirt-based hypervisors, allows remote authenticated users to write arbitrary files to the disk image via a .. (dot dot) in the path attribute of a file element.
How to fix CVE-2012-3360
To remediate CVE-2012-3360, upgrade the affected package to a fixed version below.
- Debian/nova—upgrade to 2012.1.1-2 or later
- PyPI/nova—upgrade to 12.0.0a0 or later
- —upgrade to b0feaffdb2b1c51182b8dce41b367f3449af5dd9 or later
Is CVE-2012-3360 being exploited?
Low — EPSS is 1.4%, meaning exploitation activity has not been observed at scale.
Affected packages (3)
- from 0, < 2012.1.1-2
- from 0, < 12.0.0a0
- from 0, < b0feaffdb2b1c51182b8dce41b367f3449af5dd9, < 2427d4a99bed35baefd8f17ba422cb7aae8dcca7 | from 0