RHSA-2020:3702HighCVSS 8.3

Red Hat Security Advisory: openstack-nova security update

Published
September 10, 2020
Last Modified
October 8, 2026

🔗 CVE IDs covered (1)

CVE-2020-17376 →

📋 Description

CVE-2020-17376 — openstack-nova: Soft reboot after live-migration reverts instance to original source domain XML

🎯 Affected products14

  • Red Hat OpenStack Platform 16.1
  • openstack-nova-1:20.3.1-0.20200626213436.38ee1f3.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1
  • openstack-nova-1:20.3.1-0.20200626213436.38ee1f3.el8ost.src as a component of Red Hat OpenStack Platform 16.1
  • openstack-nova-api-1:20.3.1-0.20200626213436.38ee1f3.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1
  • openstack-nova-common-1:20.3.1-0.20200626213436.38ee1f3.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1
  • openstack-nova-compute-1:20.3.1-0.20200626213436.38ee1f3.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1
  • openstack-nova-conductor-1:20.3.1-0.20200626213436.38ee1f3.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1
  • openstack-nova-console-1:20.3.1-0.20200626213436.38ee1f3.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1
  • openstack-nova-migration-1:20.3.1-0.20200626213436.38ee1f3.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1
  • openstack-nova-novncproxy-1:20.3.1-0.20200626213436.38ee1f3.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1
  • openstack-nova-scheduler-1:20.3.1-0.20200626213436.38ee1f3.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1
  • openstack-nova-serialproxy-1:20.3.1-0.20200626213436.38ee1f3.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1
  • openstack-nova-spicehtml5proxy-1:20.3.1-0.20200626213436.38ee1f3.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1
  • python3-nova-1:20.3.1-0.20200626213436.38ee1f3.el8ost.noarch as a component of Red Hat OpenStack Platform 16.1

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Public clouds using non-default configurations (allowing untrusted users to initiate live migrations) face significant additional risk. If it is not possible to immediately apply patches, a temporary policy change is recommended: disable soft reboots by setting wait_soft_reboot_seconds to zero. This effectively forces any soft reboots to instead be overridden as a hard reboot. Find more information in Nova's documentation https://docs.openstack.org/nova/ussuri/configuration/config.html Deployments which use unique device paths for each cinder volume face an extremely low risk of being affected by this flaw.

🔗 References (4)