CVE-2014-3703
OpenStack PackStack 2012.2.1, when the Open vSwitch (OVS) monolithic plug-in is not used, does...
CVE-2014-3703 is a medium vulnerability (CVSS 5.0) in Redhat Packstack, published December 2, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.16%, the 82nd percentile. Fixed in openstack-packstack 0:2013.2.1-0.33.dev1048.el6ost.
- Severity
- 5.0 MediumCVSS 2.0, NVD
- Exploit chance
- 2.16%EPSS, 82nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0:2013.2.1-0.33.dev1048.el6ostopenstack-packstack +2 more
Description
OpenStack PackStack 2012.2.1, when the Open vSwitch (OVS) monolithic plug-in is not used, does not properly set the libvirt_vif_driver configuration option when generating the nova.conf configuration, which causes the firewall to be disabled and allows remote attackers to bypass intended access restrictions.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openstack-packstackRed Hat:openstack:4::el6 | before 0:2013.2.1-0.33.dev1048.el6ost | 0:2013.2.1-0.33.dev1048.el6ost |
openstack-packstack-docRed Hat:openstack:4::el6 | before 0:2013.2.1-0.33.dev1048.el6ost | 0:2013.2.1-0.33.dev1048.el6ost |
openstack-packstack-puppetRed Hat:openstack:4::el6 | before 0:2013.2.1-0.33.dev1048.el6ost | 0:2013.2.1-0.33.dev1048.el6ost |
What each source reports
NVD Score used
OpenStack PackStack 2012.2.1, when the Open vSwitch (OVS) monolithic plug-in is not used, does not properly set the libvirt_vif_driver configuration option when generating the nova.conf configuration, which causes the firewall to be disabled and allows remote attackers to bypass intended access restrictions.
- Record
CVE-2014-3703- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE ListNo score
OpenStack PackStack 2012.2.1, when the Open vSwitch (OVS) monolithic plug-in is not used, does not properly set the libvirt_vif_driver configuration option when generating the nova.conf configuration, which causes the firewall to be disabled and allows remote attackers to bypass intended access restrictions.
- Record
CVE-2014-3703- Updated
- 2026-11-02
EUVDEUVD-2014-3649No score
OpenStack PackStack 2012.2.1, when the Open vSwitch (OVS) monolithic plug-in is not used, does not properly set the libvirt_vif_driver configuration option when generating the nova.conf configuration, which causes the firewall to be disabled and allows remote attackers to bypass intended access restrictions.
- Record
EUVD-2014-3649- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-47pg-jr9r-j5r6No score
OpenStack PackStack 2012.2.1, when the Open vSwitch (OVS) monolithic plug-in is not used, does...
OpenStack PackStack 2012.2.1, when the Open vSwitch (OVS) monolithic plug-in is not used, does not properly set the libvirt_vif_driver configuration option when generating the nova.conf configuration, which causes the firewall to be disabled and allows remote attackers to bypass intended access restrictions.
- Record
GHSA-47pg-jr9r-j5r6- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
rhn.redhat.com/errata/RHSA-2014-1691.html
nvd.nist.gov/vuln/detail/CVE-2014-3703
github.com/advisories/GHSA-47pg-jr9r-j5r6
access.redhat.com/errata/RHSA-2014:1691
bugzilla.redhat.com/show_bug.cgi?id=1075609
Show 10 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1691.json
cve.org/CVERecord?id=CVE-2014-3703