CVE-2014-0134

OpenStack Nova host data leak to vm instance in rescue mode

3.5 LowFix available

The instance rescue mode in OpenStack Compute (Nova) 2013.2 before 2013.2.3 and Icehouse before 2014.1, when using libvirt to spawn images and use_cow_images is set to false, allows remote authenticated users to read certain compute host files by overwriting an instance disk with a crafted image.

Exploit likelihood

1.49%Up 0.4 points since Feb 4, 2022

What each source reports

NVD Score used 3.5

Record: CVE-2014-0134
CVSS 2.0: 3.5 LowAV:N/AC:M/Au:S/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-0134
Updated: 2026-11-02

EUVDEUVD-2014-0036 No score

Record: EUVD-2014-0036
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w429-xc55-hc48 2.3

OpenStack Nova host data leak to vm instance in rescue mode

Record: GHSA-w429-xc55-hc48
CVSS 4.0: 2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVGHSA-w429-xc55-hc48 2.3

OpenStack Nova host data leak to vm instance in rescue mode

Record: GHSA-w429-xc55-hc48
CVSS 4.0: 2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1: 3.1 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSV No score

Record: CVE-2014-0134
Updated: 2026-11-02

OSVDEBIAN-CVE-2014-0134 No score

Record: DEBIAN-CVE-2014-0134
Updated: 2026-11-02

OSVPYSEC-2014-112 No score

Record: PYSEC-2014-112
Updated: 2026-11-02

Affected products

openstack compute

Affected packages

Affected packages
Package	Affected	Fixed
`nova` PyPI	before 12.0.0a0	12.0.0a0
`nova` Debian:12	before 2013.2.2-4	2013.2.2-4
`nova` Debian:13	before 2013.2.2-4	2013.2.2-4
`nova` Debian:14	before 2013.2.2-4	2013.2.2-4
`openstack-nova` Red Hat:openstack:4::el6	before 0:2013.2.3-7.el6ost	0:2013.2.3-7.el6ost
`openstack-nova-api` Red Hat:openstack:4::el6	before 0:2013.2.3-7.el6ost	0:2013.2.3-7.el6ost
`openstack-nova-cells` Red Hat:openstack:4::el6	before 0:2013.2.3-7.el6ost	0:2013.2.3-7.el6ost
`openstack-nova-cert` Red Hat:openstack:4::el6	before 0:2013.2.3-7.el6ost	0:2013.2.3-7.el6ost
`openstack-nova-common` Red Hat:openstack:4::el6	before 0:2013.2.3-7.el6ost	0:2013.2.3-7.el6ost
`openstack-nova-compute` Red Hat:openstack:4::el6	before 0:2013.2.3-7.el6ost	0:2013.2.3-7.el6ost

Show 8 moreShow less

Affected packages
Package	Affected	Fixed
`openstack-nova-conductor` Red Hat:openstack:4::el6	before 0:2013.2.3-7.el6ost	0:2013.2.3-7.el6ost
`openstack-nova-console` Red Hat:openstack:4::el6	before 0:2013.2.3-7.el6ost	0:2013.2.3-7.el6ost
`openstack-nova-doc` Red Hat:openstack:4::el6	before 0:2013.2.3-7.el6ost	0:2013.2.3-7.el6ost
`openstack-nova-network` Red Hat:openstack:4::el6	before 0:2013.2.3-7.el6ost	0:2013.2.3-7.el6ost
`openstack-nova-novncproxy` Red Hat:openstack:4::el6	before 0:2013.2.3-7.el6ost	0:2013.2.3-7.el6ost
`openstack-nova-objectstore` Red Hat:openstack:4::el6	before 0:2013.2.3-7.el6ost	0:2013.2.3-7.el6ost
`openstack-nova-scheduler` Red Hat:openstack:4::el6	before 0:2013.2.3-7.el6ost	0:2013.2.3-7.el6ost
`python-nova` Red Hat:openstack:4::el6	before 0:2013.2.3-7.el6ost	0:2013.2.3-7.el6ost

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0134 is a low vulnerability (CVSS 3.5) in Openstack Compute, published May 8, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.49%, the 74th percentile. Fixed in nova 12.0.0a0.

References

Show 20 moreShow less