Answer in brief
CVE-2014-3517 records a Unknown severity vulnerability in OpenStack Compute (Nova) Exposure of Sensitive Information to an Unauthorized Actor vulnerability. The current sources do not mark it as known exploited. The current feed maps nova (pypi), nova (pypi). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps nova (pypi), nova (pypi). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| novapypi | >=0 <2013.2.4 | 2013.2.4 |
| novapypi | >=2014.0.0 <2014.1.2 | 2014.1.2 |
Published upstream
May 14, 2022
Evidence: source:osv:source_dates:source-dates:recordSource modified
Sep 10, 2026
Evidence: source:osv:source_dates:source-dates:recordFirst seen by HOL
Sep 10, 2026
api/metadata/handler.py in OpenStack Compute (Nova) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2, when proxying metadata requests through Neutron, makes it easier for remote attackers to guess instance ID signatures via a brute-force attack that relies on timing differences in responses to instance metadata requests.
Quoted source text, attributed separately from HOL analysis.