CVE-2015-0259: OpenStack Compute (Nova) has Insufficient Verification of Data Authenticity
5.1
CVSS Score
Basic Information
CVE ID
GHSA ID
EPSS Score
0.42995%
CWE
Published
5/14/2022
Updated
2/8/2023
KEV Status
No
Technology
Python
PythonTechnical Details
CVSS Vector
AV:N/AC:H/Au:N/C:P/I:P/A:P
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| nova | pip | < 2014.1.4 | 2014.1.4 |
| nova | pip | >= 2014.2.0, < 2014.2.3 | 2014.2.3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability stems from missing Origin header validation in websocket handlers. The patches modify NovaProxyRequestHandler.new_client in websocketproxy.py to add verify_origin_proto checks. The absence of these checks in the original code indicates this function was the vulnerable entry point that processed unvalidated websocket connections.