CVE-2012-2654

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2012-06-21 · updated 2026-06-16
Weakness: CWE-20

Description

The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.

Affected products

OpenStack Compute: 2012.2
OpenStack Diablo: 2011.3
OpenStack Essex: 2012.1

References

http://secunia.com/advisories/46808
http://secunia.com/advisories/49439
http://www.ubuntu.com/usn/USN-1466-1
https://bugs.launchpad.net/nova/+bug/985184
https://exchange.xforce.ibmcloud.com/vulnerabilities/76110
https://github.com/openstack/nova/commit/9f9e9da777161426a6f8cb4314b78e09beac2978
https://github.com/openstack/nova/commit/ff06c7c885dc94ed7c828e8cdbb8b5d850a7e654
https://lists.launchpad.net/openstack/msg12883.html
https://review.openstack.org/#/c/8239/
http://secunia.com/advisories/46808
http://secunia.com/advisories/49439
http://www.ubuntu.com/usn/USN-1466-1

Get alerted when CVE-2012-2654 or the next vulnerability affects your stack