Your friendly security team received the following report via vendor-sec.
Please respond ASAP.
This issue is not public yet, please keep any information about it inside SUSE.
Note that build.opensuse.org *cannot* be used to prepare embargoed updates.

------------------------------------------------------------------------------
Date: Fri, 29 Jun 2012 14:14:12 +0200
From: Thierry Carrez <thierry@openstack.org>
Subject: [vs-plain] Vulnerability in OpenStack Nova

Title: Scheduler denial of service through scheduler_hints
Impact: Medium
Reporter: Dan Prince (Red Hat)
Products: Nova
Affects: Essex, Folsom series

Description:
Dan Prince from Red Hat reported a vulnerability in Nova scheduler
nodes. By creating servers with malicious scheduler_hints, an
authenticated user may generate a huge amount of database calls,
potentially resulting in a Denial of Service attack against Nova
scheduler nodes. Only setups exposing the OpenStack API and enabling
DifferentHostFilter and/or SameHostFilter are affected.

Proposed patches:
See attached diffs for current development tree (Folsom), and the Essex
backport of it. Unless a flaw is discovered in them, these proposed
patches will be merged to Nova master and stable/essex branches on
public disclosure date.