VYPR
Get started
← All advisories
Moderate severityNVD Advisory· Published Jun 21, 2012· Updated Apr 29, 2026

CVE-2012-2654

CVE-2012-2654

Description

The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1), and Diablo (2011.3) do not properly check the protocol when security groups are created and the network protocol is not specified entirely in lowercase, which allows remote attackers to bypass intended access restrictions.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
novaPyPI
< 12.0.0a012.0.0a0

Affected products

3

Patches

2
ff06c7c885dc

Fix up protocol case handling for security groups.

https://github.com/openstack/novaVishvananda IshayaJun 6, 2012via ghsa
commit
3 files changed · +4 −4
  • nova/api/ec2/cloud.py+1 −1 modified
    @@ -598,7 +598,7 @@ def _rule_dict_last_step(self, context, to_port=None, from_port=None,
                       to_port=to_port, msg="For ICMP, the"
                                            " type:code must be valid")
 
-            values['protocol'] = ip_protocol
+            values['protocol'] = ip_protocol.lower()
             values['from_port'] = from_port
             values['to_port'] = to_port
         else:
  • nova/api/openstack/compute/contrib/security_groups.py+1 −1 modified
    @@ -524,7 +524,7 @@ def _rule_args_to_dict(self, context, to_port=None, from_port=None,
                       to_port=to_port, msg="For ICMP, the"
                                            " type:code must be valid")
 
-            values['protocol'] = ip_protocol
+            values['protocol'] = ip_protocol.lower()
             values['from_port'] = from_port
             values['to_port'] = to_port
         else:
  • nova/virt/firewall.py+2 −2 modified
    @@ -331,8 +331,8 @@ def instance_rules(self, instance, network_info):
                 else:
                     fw_rules = ipv6_rules
 
-                protocol = rule.protocol
-                if version == 6 and rule.protocol == 'icmp':
+                protocol = rule.protocol.lower()
+                if version == 6 and protocol == 'icmp':
                     protocol = 'icmpv6'
 
                 args = ['-j ACCEPT']
9f9e9da77716

Fix up protocol case handling for security groups.

https://github.com/openstack/novaVishvananda IshayaJun 6, 2012via ghsa
commit
3 files changed · +4 −4
  • nova/api/ec2/cloud.py+1 −1 modified
    @@ -610,7 +610,7 @@ def _rule_dict_last_step(self, context, to_port=None, from_port=None,
                       to_port=to_port, msg="For ICMP, the"
                                            " type:code must be valid")
 
-            values['protocol'] = ip_protocol
+            values['protocol'] = ip_protocol.lower()
             values['from_port'] = from_port
             values['to_port'] = to_port
         else:
  • nova/api/openstack/compute/contrib/security_groups.py+1 −1 modified
    @@ -497,7 +497,7 @@ def _rule_args_to_dict(self, context, to_port=None, from_port=None,
                       to_port=to_port, msg="For ICMP, the"
                                            " type:code must be valid")
 
-            values['protocol'] = ip_protocol
+            values['protocol'] = ip_protocol.lower()
             values['from_port'] = from_port
             values['to_port'] = to_port
         else:
  • nova/virt/firewall.py+2 −2 modified
    @@ -300,8 +300,8 @@ def instance_rules(self, instance, network_info):
                 else:
                     fw_rules = ipv6_rules
 
-                protocol = rule.protocol
-                if version == 6 and rule.protocol == 'icmp':
+                protocol = rule.protocol.lower()
+                if version == 6 and protocol == 'icmp':
                     protocol = 'icmpv6'
 
                 args = ['-j ACCEPT']

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

13

News mentions

0

No linked articles in our index yet.