Open Redirect in CPython that affects users of OpenStack Nova

published 2022-03-02 4 y ago modified 2026-07-06 4 mo ago also GHSA-vqp6-j452-j6wp , PYSEC-2026-693 , EUVD-2022-1552

cvss: 6.1; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 26.8%; EPSS 26.8% chance of exploitation in 30 days, percentile 98%
public exploits: 0; none known, plus a Nuclei check

A vulnerability was found in openstack-nova's console proxy, noVNC. By crafting a malicious URL, noVNC could be made to redirect to any desired URL.

Patch / fix

fixed in 2 distros 3 links 7

pypi nova 21.2.3, 22.2.3, 23.0.3
openstack nova 21.2.3, 22.2.3, 23.0.3

debian ubuntu red hat

nova Debian 14, Debian 13, Debian 12 2:23.0.2-3

debian advisories DEBIAN-CVE-2021-3654

nova Ubuntu 18.04 LTS 2:17.0.13-0ubuntu5.3
nova Ubuntu 20.04 LTS 2:21.2.4-0ubuntu2.1
nova Ubuntu Pro 16.04 LTS 2:13.1.4-0ubuntu4.5+esm1

ubuntu advisories UBUNTU-CVE-2021-3654

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

python3-nova openstack 16.1 1:20.4.1-1.20220112153422.1ee93b9.el8ost
openstack-nova openstack 16.1 1:20.4.1-1.20220112153422.1ee93b9.el8ost
openstack-nova-api openstack 16.1 1:20.4.1-1.20220112153422.1ee93b9.el8ost
openstack-nova-common openstack 16.1 1:20.4.1-1.20220112153422.1ee93b9.el8ost
openstack-nova-compute openstack 16.1 1:20.4.1-1.20220112153422.1ee93b9.el8ost
openstack-nova-console openstack 16.1 1:20.4.1-1.20220112153422.1ee93b9.el8ost
openstack-nova-conductor openstack 16.1 1:20.4.1-1.20220112153422.1ee93b9.el8ost
openstack-nova-migration openstack 16.1 1:20.4.1-1.20220112153422.1ee93b9.el8ost

red hat advisories RHSA-2022:0983 RHSA-2022:0999

opendev.org/openstack/nova@04d4852 commit
opendev.org/openstack/nova@8906552 commit
security.openstack.org/ossa/OSSA-2021-002.html advisory
bugs.launchpad.net/nova/+bug/1927677 advisory
openwall.com/lists/oss-security/2021/07/29/2 advisory
bugs.python.org/issue32084 advisory
bugzilla.redhat.com/show_bug.cgi?id=1961439 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3654 updated 2026-08-07 cvss 5.7

openstack-nova: novnc allows open redirection

Red Hat OpenStack Platform 10 (Newton) python-nova, openstack-nova, python-nova-tests, openstack-nova-api, openstack-nova-cert, openstack-nova-cells, +11 more Red Hat OpenStack Platform 13 (Queens) python-nova, openstack-nova, python-nova-tests, openstack-nova-api, openstack-nova-cells, openstack-nova-common, +10 more
affected: workaround, no fix planned “Out of support scope”
Red Hat OpenStack Platform 16.1 python3-nova 20.4.1-1.20220112153422.1ee93b9.el8ost, openstack-nova 20.4.1-1.20220112153422.1ee93b9.el8ost, openstack-nova-api 20.4.1-1.20220112153422.1ee93b9.el8ost, openstack-nova-common 20.4.1-1.20220112153422.1ee93b9.el8ost, openstack-nova-compute 20.4.1-1.20220112153422.1ee93b9.el8ost, openstack-nova-console 20.4.1-1.20220112153422.1ee93b9.el8ost, +6 more
fixed: vendor fix RHSA-2022:0983
Red Hat OpenStack Platform 16.2 python3-nova 20.6.2-2.20220112164912.8906554.el8ost, openstack-nova 20.6.2-2.20220112164912.8906554.el8ost, openstack-nova-api 20.6.2-2.20220112164912.8906554.el8ost, openstack-nova-common 20.6.2-2.20220112164912.8906554.el8ost, openstack-nova-compute 20.6.2-2.20220112164912.8906554.el8ost, openstack-nova-console 20.6.2-2.20220112164912.8906554.el8ost, +6 more
fixed: vendor fix RHSA-2022:0999

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

26.79% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Nuclei template Nova noVNC - Open Redirect nuclei detection template
bugs.launchpad.net https://bugs.launchpad.net/nova/+bug/1927677 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD	2.0	4.0	AV:N/AC:H/Au:N/C:P/I:P/A:N
OSV	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
GitHub	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
pypi	nova	<21.2.3 >=22.0.0, <22.2.3 >=23.0.0, <23.0.3	21.2.3 22.2.3 23.0.3

Affected products

n/a openstack-nova

Classification

Weakness

CWE-601 URL Redirection to Untrusted Site

References

opendev.org /openstack/nova/commit/04d48527b62a35d912f93bc75613a6cca606df66
web, patch, vendor-advisory
opendev.org /openstack/nova/commit/8906552cfc2525a44251d4cf313ece61e57251eb
web, patch, vendor-advisory
security.openstack.org /ossa/OSSA-2021-002.html
web, patch, vendor-advisory
bugs.launchpad.net /nova/+bug/1927677
web, exploit, issue-tracking, patch, third-party-advisory
openwall.com /lists/oss-security/2021/07/29/2
web, mailing-list, patch, third-party-advisory
bugs.python.org /issue32084
web, patch, third-party-advisory
bugzilla.redhat.com /show_bug.cgi?id=1961439
web, issue-tracking, patch, third-party-advisory
security.gentoo.org /glsa/202305-02
vendor-advisory, web
nvd.nist.gov /vuln/detail/CVE-2021-3654
advisory
opendev.org /openstack/nova
package
pypi.org /project/nova
package
github.com /advisories/GHSA-vqp6-j452-j6wp
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary