RHSA-2020:3711HighCVSS 8.3

Red Hat Security Advisory: openstack-nova security update

Published
September 10, 2020
Last Modified
October 8, 2026

🔗 CVE IDs covered (1)

CVE-2020-17376 →

📋 Description

CVE-2020-17376 — openstack-nova: Soft reboot after live-migration reverts instance to original source domain XML

🎯 Affected products19

  • Red Hat OpenStack Platform 10.0
  • openstack-nova-1:14.1.0-65.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0
  • openstack-nova-1:14.1.0-65.el7ost.src as a component of Red Hat OpenStack Platform 10.0
  • openstack-nova-api-1:14.1.0-65.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0
  • openstack-nova-cells-1:14.1.0-65.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0
  • openstack-nova-cert-1:14.1.0-65.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0
  • openstack-nova-common-1:14.1.0-65.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0
  • openstack-nova-compute-1:14.1.0-65.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0
  • openstack-nova-conductor-1:14.1.0-65.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0
  • openstack-nova-console-1:14.1.0-65.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0
  • openstack-nova-migration-1:14.1.0-65.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0
  • openstack-nova-network-1:14.1.0-65.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0
  • openstack-nova-novncproxy-1:14.1.0-65.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0
  • openstack-nova-placement-api-1:14.1.0-65.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0
  • openstack-nova-scheduler-1:14.1.0-65.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0
  • openstack-nova-serialproxy-1:14.1.0-65.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0
  • openstack-nova-spicehtml5proxy-1:14.1.0-65.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0
  • python-nova-1:14.1.0-65.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0
  • python-nova-tests-1:14.1.0-65.el7ost.noarch as a component of Red Hat OpenStack Platform 10.0

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Public clouds using non-default configurations (allowing untrusted users to initiate live migrations) face significant additional risk. If it is not possible to immediately apply patches, a temporary policy change is recommended: disable soft reboots by setting wait_soft_reboot_seconds to zero. This effectively forces any soft reboots to instead be overridden as a hard reboot. Find more information in Nova's documentation https://docs.openstack.org/nova/ussuri/configuration/config.html Deployments which use unique device paths for each cinder volume face an extremely low risk of being affected by this flaw.

🔗 References (4)