{"id":"CVE-2014-3517","aliases":["GHSA-xjmj-p278-4jp5","PYSEC-2026-884"],"title":"OpenStack Compute (Nova) Exposure of Sensitive Information to an Unauthorized Actor vulnerability","summary":"OpenStack Compute (Nova) Exposure of Sensitive Information to an Unauthorized Actor vulnerability","severity":"medium","vendor":"nova","product":"nova","ecosystem":"pip","affected":["nova < 2013.2.4","nova >= 2014.0.0, < 2014.1.2"],"patched":["nova 2013.2.4","nova 2014.1.2"],"published":"2022-05-14","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:06.880429708Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-xjmj-p278-4jp5","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3517"},{"url":"https://access.redhat.com/errata/RHSA-2014:0940"},{"url":"https://access.redhat.com/errata/RHSA-2014:1084"},{"url":"https://access.redhat.com/security/cve/CVE-2014-3517"},{"url":"https://bugs.launchpad.net/nova/+bug/1325128"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1112499"},{"url":"https://opendev.org/openstack/nova"},{"url":"http://www.openwall.com/lists/oss-security/2014/07/17/2"}],"tags":["osv","pip"],"epss":0.01954,"epssPercentile":0.79127,"ingestedAt":"2026-07-08T18:25:54.200Z","slug":"CVE-2014-3517","body":"## Overview\n\napi/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying metadata requests through Neutron, makes it easier for remote attackers to guess instance ID signatures via a brute-force attack that relies on timing differences in responses to instance metadata requests.\n\n## Affected packages\n\n- `nova < 2013.2.4`\n- `nova >= 2014.0.0, < 2014.1.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `nova 2013.2.4`\n- `nova 2014.1.2`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}