CVE-2017-17051

Name	CVE-2017-17051
Description	An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. By repeatedly rebuilding an instance with new images, an authenticated user may consume untracked resources on a hypervisor host leading to a denial of service, aka doubled resource allocations. This regression was introduced with the fix for OSSA-2017-005 (CVE-2017-16239); however, only Nova stable/pike or later deployments with that fix applied and relying on the default FilterScheduler are affected.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium (attack range: remote)
Debian Bugs	883621

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nova (PTS)	jessie	2014.1.3-11	fixed
	stretch (security), stretch	2:14.0.0-4+deb9u1	fixed
	bullseye, buster	2:18.1.0-6	fixed
	sid	2:19.0.2-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
nova	source	(unstable)	2:16.0.3-6	medium	883621
nova	source	jessie	(not affected)
nova	source	stretch	(not affected)
nova	source	wheezy	(not affected)

Notes

[stretch] - nova <not-affected> (Fix for CVE-2017-16239 not applied and not affecting 14.x.y)
[jessie] - nova <not-affected> (Vulnerable code not present)
[wheezy] - nova <not-affected> (Vulnerable code not present)
http://www.openwall.com/lists/oss-security/2017/12/05/5
https://launchpad.net/bugs/1732976