Openstack Icehouse vulnerabilities

4 CVEs affecting Openstack Icehouse, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-1851, published 2015-06-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-1851, published 2015-06-25. Medium severity, CVSS 6.8. EPSS: 2.6% chance of exploitation in the next 30 days. OpenStack Cinder before 2014.1.5 (icehouse), 2014.2.x before 2014.2.4 (juno), and 2015.1.x before 2015.1.1 (kilo) allows remote authenticated users to read arbitrary files via a crafted qcow2…
CVE-2013-7130, published 2014-02-06. High severity, CVSS 7.1. EPSS: 2.4% chance of exploitation in the next 30 days. The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not…
CVE-2014-0162, published 2014-04-27. Medium severity, CVSS 6.0. EPSS: 2% chance of exploitation in the next 30 days. The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allows remote authenticated users with permission to insert or…
CVE-2014-0167, published 2014-04-15. Medium severity, CVSS 6.0. EPSS: 1.7% chance of exploitation in the next 30 days. The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 does not enforce RBAC policies for (1) add_rules, (2) remove_rules,…