Skip to content
Fencer Vulns
critical 9.9

CVE-2020-10731 json

A flaw was found in the nova_libvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled.

published 2020-07-31 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-3156

cvss
9.9
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

A flaw was found in the nova_libvirt container provided by the Red Hat OpenStack Platform 16, where it does not have SELinux enabled. This flaw causes sVirt, an important isolation mechanism, to be disabled for all running virtual machines.

Patch / fix

  • python-paunch openstack 16 5.3.2-0.20200320172310.ebc49c4.el8ost
  • openstack-tripleo-heat-templates openstack 16 11.3.2-0.20200405044628.ec9970c.el8ost
  • python3-paunch openstack 16 5.3.2-0.20200320172310.ebc49c4.el8ost
  • paunch-services openstack 16 5.3.2-0.20200320172310.ebc49c4.el8ost
  • python-paunch openstack 15 4.5.3-0.20200108190460.3c38fe6.el8ost
  • openstack-tripleo-heat-templates openstack 15 10.6.3-0.20200113185561.cf467ea.el8ost
  • python3-paunch openstack 15 4.5.3-0.20200108190460.3c38fe6.el8ost
  • paunch-services openstack 15 4.5.3-0.20200108190460.3c38fe6.el8ost

red hat advisories RHSA-2020:3406RHSA-2020:3410RHSA-2020:3199

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-10731 updated cvss 9.9

openstack-tripleo-heat-templates: No sVirt protection for OSP16 VMs due to disabled SELinux

  • Red Hat OpenStack Platform 15.0 python-paunch 4.5.3-0.20200108190460.3c38fe6.el8ost, python3-paunch 4.5.3-0.20200108190460.3c38fe6.el8ost, paunch-services 4.5.3-0.20200108190460.3c38fe6.el8ost, openstack-tripleo-heat-templates 10.6.3-0.20200113185561.cf467ea.el8ost
    fixed: vendor fix RHSA-2020:3410
  • Red Hat OpenStack Platform 16.0 python-paunch 5.3.2-0.20200320172310.ebc49c4.el8ost, python3-paunch 5.3.2-0.20200320172310.ebc49c4.el8ost, paunch-services 5.3.2-0.20200320172310.ebc49c4.el8ost, openstack-tripleo-heat-templates 11.3.2-0.20200405044628.ec9970c.el8ost
    fixed: vendor fix RHSA-2020:3406
  • Red Hat OpenStack Platform 16.1 openstack-tripleo-heat-templates 11.3.2-0.20200616081532.396affd.el8ost
    fixed: vendor fix RHSA-2020:3199
  • Red Hat OpenStack Platform 10 (Newton) openstack-tripleo-heat-templates Red Hat OpenStack Platform 13 (Queens) openstack-tripleo-heat-templates
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.89% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 2.0 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P

Affected products

  • n/a nova_libvirt container provided by the Red Hat OpenStack Platform

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.