CVE request for a vulnerability in OpenStack Nova

[Thierry Carrez <thierry () openstack org>]

A vulnerability was discovered in OpenStack (see below). In order to
ensure full traceability, we need a CVE number assigned that we can
attach to further notifications. This issue is already public,
although an advisory was not sent yet.

"""
Title: Nova live snapshots use an insecure local directory
Reporter: Daniel Berrange (Red Hat)
Products: Nova
Affects: Grizzly and later

Description:
Daniel Berrange from Red Hat reported that the directories used to
temporarily store live snapshots on Nova compute nodes were writeable to
all local users. A local attacker with shell access on compute nodes
could therefore read and modify the contents of live snapshots before
those are uploaded to the image service.
"""

References:
https://bugs.launchpad.net/nova/+bug/1227027

Thanks in advance,

-- 
Thierry Carrez (ttx)
OpenStack Vulnerability Management Team

Attachment: signature.asc
Description: OpenPGP digital signature