CVE-2014-3517
api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying metadata requests through Neutron, makes it easier for remote attackers to guess instance ID signatures via a brute-force attack that relies on timing differences in responses to instance metadata requests.
- EPSS
- 2.0% chance of exploitation in the next 30 days; higher than 80% of CVEs (scores of 2026-10-31)
- CWE
- CWE-200
- Published
- Modified
- Record from
- the NVD, synced
Affected
- openstack:nova
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-xjmj-p278-4jp5 | PyPI | nova | <2013.2.4 | 2013.2.4 |
| GHSA-xjmj-p278-4jp5 | PyPI | nova | >=2014.0.0 <2014.1.2 | 2014.1.2 |
| PYSEC-2026-884 | PyPI | nova | <2013.2.4 >=2014.0.0 <2014.1.2 | 2013.2.4, 2014.1.2 |