CVE catalog
CVE-2017-16239
nova: CVE-2017-16239
- Severity
- Medium · CVSS 5.4
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.42% · Oct 25, 2026
In OpenStack Nova through 14.0.9, 15.x through 15.0.7, and 16.x through 16.0.2, by rebuilding an instance, an authenticated user may be able to circumvent the Filter Scheduler bypassing imposed filters (for example, the ImagePropertiesFilter or the IsolatedHostsFilter). All setups using Nova Filter Scheduler are affected. Because of the regression described in Launchpad Bug #1732947, the preferred fix is a 14.x version after 14.0.10, a 15.x version after 15.0.8, or a 16.x version after 16.0.3.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | nova | sid | 2:34.0.0-4 | fixed |
| Debian | nova | forky | 2:33.0.2-1 | fixed |
| Debian | nova | trixie | 2:31.0.0-6+deb13u2 | fixed |
| Debian | nova | trixie-security | 2:31.0.0-6+deb13u2 | fixed |
| Debian | nova | bookworm | 2:26.2.2-1~deb12u4 | fixed |
| Debian | nova | bookworm-security | 2:26.2.2-1~deb12u4 | fixed |
| Suse | openstack-nova | openstack cloud 7 | 14.0.10~dev13-4.11.1 | fixed |
| Suse | openstack-nova-doc | openstack cloud 7 | 14.0.10~dev13-4.11.3 | fixed |
| Ubuntu | nova | pro | 2:12.0.0-0ubuntu2 | vulnerable |
| Ubuntu | nova | pro | 2:13.0.0~b1-0ubuntu1 | vulnerable |
| Ubuntu | nova | pro | 2:13.0.0~b2-0ubuntu1 | vulnerable |
| Ubuntu | nova | pro | 2:13.0.0~b3-0ubuntu1 | vulnerable |
| Ubuntu | nova | pro | 2:13.0.0~rc1-0ubuntu1 | vulnerable |
| Ubuntu | nova | pro | 2:13.0.0~rc3-0ubuntu1 | vulnerable |
| Ubuntu | nova | pro | 2:13.0.0-0ubuntu1 | vulnerable |
| Ubuntu | nova | pro | 2:13.0.0-0ubuntu2 | vulnerable |
| Ubuntu | nova | pro | 2:13.0.0-0ubuntu5 | vulnerable |
| Ubuntu | nova | pro | 2:13.1.0-0ubuntu1 | vulnerable |
| Ubuntu | nova | pro | 2:13.1.1-0ubuntu1 | vulnerable |
| Ubuntu | nova | pro | 2:13.1.1-0ubuntu1.1 | vulnerable |
| Ubuntu | nova | pro | 2:13.1.2-0ubuntu2 | vulnerable |
| Ubuntu | nova | pro | 2:13.1.3-0ubuntu1 | vulnerable |
| Ubuntu | nova | pro | 2:13.1.3-0ubuntu2 | vulnerable |
| Ubuntu | nova | pro | 2:13.1.4-0ubuntu1 | vulnerable |
| Ubuntu | nova | pro | 2:13.1.4-0ubuntu2 | vulnerable |
| Ubuntu | nova | pro | 2:13.1.4-0ubuntu3 | vulnerable |
| Ubuntu | nova | pro | 2:13.1.4-0ubuntu4.1 | vulnerable |
| Ubuntu | nova | pro | 2:13.1.4-0ubuntu4.2 | vulnerable |
| Ubuntu | nova | pro | 2:13.1.4-0ubuntu4.3 | vulnerable |
| Ubuntu | nova | pro | 2:13.1.4-0ubuntu4.4 | vulnerable |
| Ubuntu | nova | pro | 2:13.1.4-0ubuntu4.5 | vulnerable |
| Ubuntu | nova | pro | 2:13.1.4-0ubuntu4.5+esm1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | nova | source | sid | 2:16.0.3-1 | not yet assigned | Not reported | [882009] |
| Debian | nova | source | forky | 2:16.0.3-1 | not yet assigned | Not reported | [882009] |
| Debian | nova | source | trixie | 2:16.0.3-1 | not yet assigned | Not reported | [882009] |
| Debian | nova | source | bookworm | 2:16.0.3-1 | not yet assigned | Not reported | [882009] |
| Suse | openstack-nova | rpm | openstack cloud 7 | 14.0.10~dev13-4.11.1 | Not reported | SUSE-SU-2017:3080-1 | Not reported |
| Suse | openstack-nova-doc | rpm | openstack cloud 7 | 14.0.10~dev13-4.11.3 | Not reported | SUSE-SU-2017:3080-1 | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [nova-api]Unknown
Source package: [nova]
Details (4)
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
- [nova-common]Unknown
Source package: [nova]
Details (4)
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
- [nova-compute]Unknown
Source package: [nova]
Details (4)
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
- [nova-compute-ironic]Unknown
Source package: [nova]
Details (4)
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
- [nova-compute-kvm]Unknown
Source package: [nova]
Details (4)
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
- [nova-compute-lxc]Unknown
Source package: [nova]
Details (4)
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
- [nova-compute-qemu]Unknown
Source package: [nova]
Details (4)
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
- [nova-conductor]Unknown
Source package: [nova]
Details (4)
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
- [nova-consoleproxy]Unknown
Source package: [nova]
Details (4)
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
- [nova-doc]Unknown
Source package: [nova]
Details (4)
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
- [nova-scheduler]Unknown
Source package: [nova]
Details (4)
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
- [python3-nova]Unknown
Source package: [nova]
Details (4)
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookwormFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
2:26.2.2-1~deb12u4· all · bookworm-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · bookworm; dsa · nova · debian · 12
[Debian 13 (Trixie)]
- [nova-api]Unknown
Source package: [nova]
Details (4)
2:31.0.0-6+deb13u2· all · trixieFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixieFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixie-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixie-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
- [nova-common]Unknown
Source package: [nova]
Details (4)
2:31.0.0-6+deb13u2· all · trixieFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixieFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixie-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixie-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
- [nova-compute]Unknown
Source package: [nova]
Details (4)
2:31.0.0-6+deb13u2· all · trixieFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixieFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixie-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixie-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
- [nova-compute-ironic]Unknown
Source package: [nova]
Details (4)
2:31.0.0-6+deb13u2· all · trixieFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixieFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixie-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixie-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
- [nova-compute-kvm]Unknown
Source package: [nova]
Details (4)
2:31.0.0-6+deb13u2· all · trixieFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixieFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixie-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixie-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
- [nova-compute-lxc]Unknown
Source package: [nova]
Details (4)
2:31.0.0-6+deb13u2· all · trixieFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixieFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixie-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixie-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
- [nova-compute-qemu]Unknown
Source package: [nova]
Details (4)
2:31.0.0-6+deb13u2· all · trixieFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixieFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixie-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixie-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
- [nova-conductor]Unknown
Source package: [nova]
Details (4)
2:31.0.0-6+deb13u2· all · trixieFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixieFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixie-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
2:31.0.0-6+deb13u2· all · trixie-securityFixed · Fixed:
2:16.0.3-1dsa · nova · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_3080-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2017-16239]
- [https://osv.dev/vulnerability/DSA-4056-1]
- [https://osv.dev/vulnerability/SUSE-SU-2017:3080-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2017-16239]
- [https://security-tracker.debian.org/tracker/CVE-2017-16239]
- [https://security.access.redhat.com/data/csaf/v2/vex/2017/cve-2017-16239.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]