Matt Riedemann

**Name of the Vulnerable Software and Affected Versions** OpenStack Nova versions 16.0.3 **Description** An issue in the default FilterScheduler allows an authenticated user to cause a denial of service by consuming untracked resources on a hypervisor host through repeated instance rebuilding with new images. This leads to doubled resource allocations. **Recommendations** For OpenStack Nova version 16.0.3, consider disabling the default FilterScheduler as a temporary workaround until a patch is available. Restrict access to instance rebuilding with new images to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenStack Nova versions 13.x through 13.1.3 OpenStack Nova versions 14.x through 14.0.4 OpenStack Nova versions 15.x through 15.0.1 **Description** An issue in exception wrapper.py may cause legacy notification exception contexts to include sensitive information, such as account passwords and authorization tokens, in ERROR level logs. **Recommendations** For versions 13.x through 13.1.3, update to a version later than 13.1.3 to resolve the issue. For versions 14.x through 14.0.4, update to a version later than 14.0.4 to resolve the issue. For versions 15.x through 15.0.1, update to a version later than 15.0.1 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** OpenStack Compute (Nova) versions prior to 2015.1.3 (kilo) OpenStack Compute (Nova) versions 12.0.x prior to 12.0.1 (liberty) **Description** The issue concerns the `volume utils. parse volume info` function, which includes the `connection info` dictionary in the StorageError message when using the Xen backend. This might allow attackers to obtain sensitive password information by reading log files. **Recommendations** For versions prior to 2015.1.3 (kilo), update to version 2015.1.3 or later. For versions 12.0.x prior to 12.0.1 (liberty), update to version 12.0.1 or later.