CVE-2017-2637
A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable...
A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default (by director) listening on 0.0.0.0 (all interfaces) with no-authentication or encryption. Anyone able to make a TCP connection to any compute host IP address, including 127.0.0.1, other loopback interface addresses, or in some cases possibly addresses that have been exposed beyond the management interface, could use this to open a virsh session to the libvirtd instance and gain control of virtual machine instances or possibly take over the host.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default (by director) listening on 0.0.0.0 (all interfaces) with no-authentication or encryption. Anyone able to make a TCP connection to any compute host IP address, including 127.0.0.1, other loopback interface addresses, or in some cases possibly addresses that have been exposed beyond the management interface, could use this to open a virsh session to the libvirtd instance and gain control of virtual machine instances or possibly take over the host.
- Record
CVE-2017-2637- CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L - Weakness
- CWE-306
- Updated
- 2026-11-02
EUVDEUVD-2017-11798
A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default (by director) listening on 0.0.0.0 (all interfaces) with no-authentication or encryption. Anyone able to make a TCP connection to any compute host IP address, including 127.0.0.1, other loopback interface addresses, or in some cases possibly addresses that have been exposed beyond the management interface, could use this to open a virsh session to the libvirtd instance and gain control of virtual machine instances or possibly take over the host.
- Record
EUVD-2017-11798- CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w8fq-h7pg-632c
A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable...
A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default (by director) listening on 0.0.0.0 (all interfaces) with no-authentication or encryption. Anyone able to make a TCP connection to any compute host IP address, including 127.0.0.1, other loopback interface addresses, or in some cases possibly addresses that have been exposed beyond the management interface, could use this to open a virsh session to the libvirtd instance and gain control of virtual machine instances or possibly take over the host.
- Record
GHSA-w8fq-h7pg-632c- CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-306
- Updated
- 2026-11-02
NVD
A design flaw issue was found in the Red Hat OpenStack Platform director use of TripleO to enable libvirtd based live-migration. Libvirtd is deployed by default (by director) listening on 0.0.0.0 (all interfaces) with no-authentication or encryption. Anyone able to make a TCP connection to any compute host IP address, including 127.0.0.1, other loopback interface addresses, or in some cases possibly addresses that have been exposed beyond the management interface, could use this to open a virsh session to the libvirtd instance and gain control of virtual machine instances or possibly take over the host.
- Record
CVE-2017-2637- CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L - CVSS 3.0
- 10.0 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-306
- Updated
- 2026-11-02
OSVRHSA-2017:1242
Red Hat Security Advisory: Red Hat OpenStack Platform director security update
- Record
RHSA-2017:1242- CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2017:1504
Red Hat Security Advisory: Red Hat OpenStack Platform director security update
- Record
RHSA-2017:1504- CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2017:1537
Red Hat Security Advisory: Red Hat OpenStack Platform director security update
- Record
RHSA-2017:1537- CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
OSVRHSA-2017:1546
Red Hat Security Advisory: Red Hat OpenStack Platform director security update
- Record
RHSA-2017:1546- CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openstack-novaRed Hat:openstack:10::el7 |
before 1:14.0.3-9.el7ost | 1:14.0.3-9.el7ost |
openstack-nova-apiRed Hat:openstack:10::el7 |
before 1:14.0.3-9.el7ost | 1:14.0.3-9.el7ost |
openstack-nova-cellsRed Hat:openstack:10::el7 |
before 1:14.0.3-9.el7ost | 1:14.0.3-9.el7ost |
openstack-nova-certRed Hat:openstack:10::el7 |
before 1:14.0.3-9.el7ost | 1:14.0.3-9.el7ost |
openstack-nova-commonRed Hat:openstack:10::el7 |
before 1:14.0.3-9.el7ost | 1:14.0.3-9.el7ost |
openstack-nova-computeRed Hat:openstack:10::el7 |
before 1:14.0.3-9.el7ost | 1:14.0.3-9.el7ost |
openstack-nova-conductorRed Hat:openstack:10::el7 |
before 1:14.0.3-9.el7ost | 1:14.0.3-9.el7ost |
openstack-nova-consoleRed Hat:openstack:10::el7 |
before 1:14.0.3-9.el7ost | 1:14.0.3-9.el7ost |
openstack-nova-migrationRed Hat:openstack:10::el7 |
before 1:14.0.3-9.el7ost | 1:14.0.3-9.el7ost |
openstack-nova-networkRed Hat:openstack:10::el7 |
before 1:14.0.3-9.el7ost | 1:14.0.3-9.el7ost |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
openstack-nova-novncproxyRed Hat:openstack:10::el7 |
before 1:14.0.3-9.el7ost | 1:14.0.3-9.el7ost |
openstack-nova-placement-apiRed Hat:openstack:10::el7 |
before 1:14.0.3-9.el7ost | 1:14.0.3-9.el7ost |
openstack-nova-schedulerRed Hat:openstack:10::el7 |
before 1:14.0.3-9.el7ost | 1:14.0.3-9.el7ost |
openstack-nova-serialproxyRed Hat:openstack:10::el7 |
before 1:14.0.3-9.el7ost | 1:14.0.3-9.el7ost |
openstack-nova-spicehtml5proxyRed Hat:openstack:10::el7 |
before 1:14.0.3-9.el7ost | 1:14.0.3-9.el7ost |
openstack-tripleo-commonRed Hat:openstack:10::el7 |
before 0:5.4.1-6.el7ost | 0:5.4.1-6.el7ost |
openstack-tripleo-heat-templatesRed Hat:openstack:10::el7 |
before 0:5.2.0-15.el7ost | 0:5.2.0-15.el7ost |
openstack-tripleo-puppet-elementsRed Hat:openstack:10::el7 |
before 0:5.2.0-3.el7ost | 0:5.2.0-3.el7ost |
puppet-novaRed Hat:openstack:10::el7 |
before 0:9.5.0-4.el7ost | 0:9.5.0-4.el7ost |
puppet-tripleoRed Hat:openstack:10::el7 |
before 0:5.5.0-12.el7ost | 0:5.5.0-12.el7ost |
python-novaRed Hat:openstack:10::el7 |
before 1:14.0.3-9.el7ost | 1:14.0.3-9.el7ost |
python-nova-testsRed Hat:openstack:10::el7 |
before 1:14.0.3-9.el7ost | 1:14.0.3-9.el7ost |
openstack-tripleo-heat-templatesRed Hat:openstack-director:9::el7 |
before 0:2.0.0-57.el7ost | 0:2.0.0-57.el7ost |
openstack-tripleo-heat-templates-libertyRed Hat:openstack-director:9::el7 |
before 0:2.0.0-57.el7ost | 0:2.0.0-57.el7ost |
openstack-tripleo-puppet-elementsRed Hat:openstack-director:9::el7 |
before 0:2.0.0-6.el7ost | 0:2.0.0-6.el7ost |
python-tripleoclientRed Hat:openstack-director:9::el7 |
before 0:2.0.0-14.el7ost | 0:2.0.0-14.el7ost |
openstack-tripleo-heat-templatesRed Hat:openstack-director:7::el7 |
before 0:0.8.6-135.el7ost | 0:0.8.6-135.el7ost |
openstack-tripleo-puppet-elementsRed Hat:openstack-director:7::el7 |
before 0:0.0.1-6.el7ost | 0:0.0.1-6.el7ost |
python-rdomanager-oscpluginRed Hat:openstack-director:7::el7 |
before 0:0.0.10-34.el7ost | 0:0.0.10-34.el7ost |
openstack-tripleo-heat-templatesRed Hat:openstack-director:8::el7 |
before 0:0.8.14-29.el7ost | 0:0.8.14-29.el7ost |
openstack-tripleo-heat-templates-kiloRed Hat:openstack-director:8::el7 |
before 0:0.8.14-29.el7ost | 0:0.8.14-29.el7ost |
openstack-tripleo-puppet-elementsRed Hat:openstack-director:8::el7 |
before 0:0.0.5-2.el7ost | 0:0.0.5-2.el7ost |
python-tripleoclientRed Hat:openstack-director:8::el7 |
before 0:0.3.4-14.el7ost | 0:0.3.4-14.el7ost |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-2637 is a critical vulnerability (CVSS 9.9) in Redhat Openstack, published July 26, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.60%, the 91st percentile. Fixed in openstack-nova 1:14.0.3-9.el7ost.
References
access.redhat.com/errata/RHSA-2017:1546
bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2637
securityfocus.com/bid/98576
wiki.openstack.org/wiki/OSSN/OSSN-0007
Show 21 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-2637
github.com/advisories/GHSA-w8fq-h7pg-632c
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1242.json
cve.org/CVERecord?id=CVE-2017-2637