Vulnerabilites related to openstack - havana
Vulnerability from fkie_nvd
Published
2013-07-09 17:55
Modified
2024-11-21 01:51
Severity ?
Summary
OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by creating an image with a large virtual size that does not contain a large amount of data.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openstack:folsom:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F5BA13BC-F088-45AA-AD10-B74F89CE5375",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:grizzly:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A83ED744-9E3D-4510-B3E6-6DDE1090F0B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:havana:-:*:*:*:*:*:*:*",
"matchCriteriaId": "77522028-683C-4708-AF46-50B49A0A2D15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by creating an image with a large virtual size that does not contain a large amount of data."
},
{
"lang": "es",
"value": "Folsom, Grizzly y Havana de OpenStack Compute (Nova), no comprueba el tama\u00f1o virtual de una imagen QCOW2, lo que permite a los usuarios locales causar una denegaci\u00f3n de servicio (consumo de disco del sistema de archivos host) creando una imagen con un gran tama\u00f1o virtual que s\u00ed, no contiene una gran cantidad de datos."
}
],
"id": "CVE-2013-2096",
"lastModified": "2024-11-21T01:51:01.540",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-07-09T17:55:01.093",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://lists.openstack.org/pipermail/openstack-announce/2013-May/000102.html"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/59924"
},
{
"source": "secalert@redhat.com",
"url": "http://www.ubuntu.com/usn/USN-1831-1"
},
{
"source": "secalert@redhat.com",
"url": "https://review.openstack.org/#/c/28717/"
},
{
"source": "secalert@redhat.com",
"url": "https://review.openstack.org/#/c/28901/"
},
{
"source": "secalert@redhat.com",
"url": "https://review.openstack.org/#/c/29192/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://lists.openstack.org/pipermail/openstack-announce/2013-May/000102.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/59924"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-1831-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://review.openstack.org/#/c/28717/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://review.openstack.org/#/c/28901/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://review.openstack.org/#/c/29192/"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-399"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-08-20 22:55
Modified
2024-11-21 01:54
Severity ?
Summary
OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp that is older than expected.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| openstack | folsom | - | |
| openstack | grizzly | - | |
| openstack | havana | - | |
| openstack | swift | * | |
| openstack | swift | 1.0.0 | |
| openstack | swift | 1.0.1 | |
| openstack | swift | 1.0.2 | |
| openstack | swift | 1.1.0 | |
| openstack | swift | 1.1.0 | |
| openstack | swift | 1.1.0 | |
| openstack | swift | 1.2.0 | |
| openstack | swift | 1.2.0 | |
| openstack | swift | 1.2.0 | |
| openstack | swift | 1.3.0 | |
| openstack | swift | 1.3.0 | |
| openstack | swift | 1.3.0 | |
| openstack | swift | 1.4.0 | |
| openstack | swift | 1.4.1 | |
| openstack | swift | 1.4.2 | |
| openstack | swift | 1.4.3 | |
| openstack | swift | 1.4.4 | |
| openstack | swift | 1.4.5 | |
| openstack | swift | 1.4.6 | |
| openstack | swift | 1.4.7 | |
| openstack | swift | 1.4.8 | |
| openstack | swift | 1.5.0 | |
| openstack | swift | 1.6.0 | |
| openstack | swift | 1.7.0 | |
| openstack | swift | 1.7.2 | |
| openstack | swift | 1.7.4 | |
| openstack | swift | 1.7.5 | |
| openstack | swift | 1.7.6 | |
| openstack | swift | 1.8.0 | |
| openstack | swift | 1.8.0 | |
| openstack | swift | 1.8.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openstack:folsom:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F5BA13BC-F088-45AA-AD10-B74F89CE5375",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:grizzly:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A83ED744-9E3D-4510-B3E6-6DDE1090F0B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:havana:-:*:*:*:*:*:*:*",
"matchCriteriaId": "77522028-683C-4708-AF46-50B49A0A2D15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:*:*:*:*:*:*:*:*",
"matchCriteriaId": "8E81B0AB-FE07-480C-AA06-7123D158A01F",
"versionEndIncluding": "1.9.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D3363F1D-E377-4884-A982-95C16230282E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "09BA82A3-AD2E-4767-AC55-B77112E1E8B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "9B48FA39-ACAC-4176-954A-E244E5C40B43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1E05C078-59BA-42E9-B46D-EA2F1A7A3AC2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.1.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "6D4E8964-8F13-4202-B8FC-803C55E4DD07",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.1.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "A22B59DB-7F87-4FAD-B717-3636887FFB0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "01DD589E-25BC-4189-AC9C-3C339B64CBB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.2.0:gamma1:*:*:*:*:*:*",
"matchCriteriaId": "D752F8FE-8B75-412A-997E-C276B61E5A25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "04839CE3-2C55-4A95-A569-DB33C38EDCB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.3.0:*:*:*:*:*:*:*",
"matchCriteriaId": "77C700EB-E00A-49B3-8A73-E075CEC3D60A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.3.0:gamma1:*:*:*:*:*:*",
"matchCriteriaId": "6AAF1C7D-65A2-4DDD-B9DF-E947DE7D9394",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.3.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "FB71CE04-A7C2-4859-A95B-61E9FC27D955",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "5FA8EC8C-E00A-4E0D-BAF4-3EA0F6D0542D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "190BEFEB-F468-44DD-8E5B-44AC6586E8B2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.4.2:*:*:*:*:*:*:*",
"matchCriteriaId": "673B78FE-6D79-4603-AF96-14654B87D6DB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.4.3:*:*:*:*:*:*:*",
"matchCriteriaId": "349679DF-B0AB-4238-8DA5-383FE1D1E595",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.4.4:*:*:*:*:*:*:*",
"matchCriteriaId": "5BF8C72E-C20B-4A1B-A2CA-9FB39BBD3F36",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.4.5:*:*:*:*:*:*:*",
"matchCriteriaId": "F4F16BA8-B732-4633-A1F5-244482249B11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.4.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9F65289A-8F41-4DFC-9B7E-C45F2A572C3E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.4.7:*:*:*:*:*:*:*",
"matchCriteriaId": "3EE50F0A-4411-48AC-89DD-530B44C46256",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.4.8:*:*:*:*:*:*:*",
"matchCriteriaId": "0CF91F03-51B1-4CF6-AE2A-2A03CFE2000A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E3697251-8EEA-4458-9717-155EAD0915F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A9A118EA-10DD-4B99-9B49-9A36580C44CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E42DBA52-96EE-4662-8CB2-C2606E75CBA6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "29F37244-947C-479B-9F52-5D22BC5276EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9ED958FC-7275-4CF5-90A7-D05ACE84B523",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "945E4B61-33E9-4578-B778-231ACD281A40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "953ED594-AF1B-4580-BC8D-05EF3CD71F6D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2743AB4B-6A56-4E86-A5D7-3D1066032202",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.8.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "5928EF1B-B236-475A-B204-82CAA30B1E22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:swift:1.8.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "33075789-58EE-4A71-8BA1-C3A515248DE4",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service (\"superfluous\" tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp that is older than expected."
},
{
"lang": "es",
"value": "OpenStack Swift nateior a 1.9.1 en Folsom, Grizzly, y Havana, permite a usuarios autenticados provocar una denegaci\u00f3n de servicio (consumo superfluo de tombstone y desaceleraci\u00f3n del cl\u00faster Swift) a trav\u00e9s de una petici\u00f3n DELETE con un timestamp que es m\u00e1s antiguo que el esperado."
}
],
"id": "CVE-2013-4155",
"lastModified": "2024-11-21T01:54:59.023",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-08-20T22:55:04.260",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1197.html"
},
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2012/dsa-2737"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2013/08/07/6"
},
{
"source": "secalert@redhat.com",
"url": "http://www.ubuntu.com/usn/USN-2001-1"
},
{
"source": "secalert@redhat.com",
"url": "https://bugs.launchpad.net/swift/+bug/1196932"
},
{
"source": "secalert@redhat.com",
"url": "https://review.openstack.org/#/c/40643/"
},
{
"source": "secalert@redhat.com",
"url": "https://review.openstack.org/#/c/40645/"
},
{
"source": "secalert@redhat.com",
"url": "https://review.openstack.org/#/c/40646/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1197.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2737"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2013/08/07/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-2001-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugs.launchpad.net/swift/+bug/1196932"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://review.openstack.org/#/c/40643/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://review.openstack.org/#/c/40645/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://review.openstack.org/#/c/40646/"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-02-06 05:44
Modified
2024-11-21 01:55
Severity ?
Summary
OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) via a compressed QCOW2 image. NOTE: this issue is due to an incomplete fix for CVE-2013-2096.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openstack:folsom:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F5BA13BC-F088-45AA-AD10-B74F89CE5375",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:grizzly:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A83ED744-9E3D-4510-B3E6-6DDE1090F0B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:havana:-:*:*:*:*:*:*:*",
"matchCriteriaId": "77522028-683C-4708-AF46-50B49A0A2D15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) via a compressed QCOW2 image. NOTE: this issue is due to an incomplete fix for CVE-2013-2096."
},
{
"lang": "es",
"value": "OpenStack Compute (Nova) Folsom, Grizzly y Havana no verifican debidamente el tama\u00f1o virtual de una imagen QCOW2, lo que permite a usuarios locales causar un denegaci\u00f3n de servicio (consumo de disco del sistema de archivos host) a trav\u00e9s de una imagen QCOW2 comprimida. NOTA: este problema es debido a una soluci\u00f3n incompleta en CVE-2013-2096."
}
],
"id": "CVE-2013-4463",
"lastModified": "2024-11-21T01:55:37.120",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-02-06T05:44:24.177",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0112.html"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2013/10/31/3"
},
{
"source": "secalert@redhat.com",
"url": "http://www.ubuntu.com/usn/USN-2247-1"
},
{
"source": "secalert@redhat.com",
"url": "https://bugs.launchpad.net/nova/+bug/1206081"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0112.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2013/10/31/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-2247-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugs.launchpad.net/nova/+bug/1206081"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-399"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-11-02 19:55
Modified
2024-11-21 01:55
Severity ?
Summary
The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openstack:grizzly:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A83ED744-9E3D-4510-B3E6-6DDE1090F0B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:havana:-:*:*:*:*:*:*:*",
"matchCriteriaId": "77522028-683C-4708-AF46-50B49A0A2D15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges."
},
{
"lang": "es",
"value": "El backend LDAP en OpenStack Identity (Keystone) Grizzly y Habana, cuando al retirar un rol de un inquilino para un usuario que no tiene esa funci\u00f3n, a\u00f1ade el role al usuario, lo que permite a usuarios locales conseguir privilegios."
}
],
"id": "CVE-2013-4477",
"lastModified": "2024-11-21T01:55:38.870",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
]
},
"published": "2013-11-02T19:55:04.773",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0113.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2013/10/30/6"
},
{
"source": "secalert@redhat.com",
"url": "http://www.ubuntu.com/usn/USN-2034-1"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit"
],
"url": "https://bugs.launchpad.net/keystone/+bug/1242855"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0113.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2013/10/30/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-2034-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://bugs.launchpad.net/keystone/+bug/1242855"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-08-20 22:55
Modified
2024-11-21 01:51
Severity ?
Summary
XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofed Swift responses via an account name.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openstack:folsom:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F5BA13BC-F088-45AA-AD10-B74F89CE5375",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:grizzly:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A83ED744-9E3D-4510-B3E6-6DDE1090F0B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:havana:-:*:*:*:*:*:*:*",
"matchCriteriaId": "77522028-683C-4708-AF46-50B49A0A2D15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*",
"matchCriteriaId": "DFBF430B-0832-44B0-AA0E-BA9E467F7668",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofed Swift responses via an account name."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n XML en accounts/utils.py en OpenStack Swift Folsom, Grizzly, y Havana, permite a atacantes provocar o suplantar respuestas Swift a trav\u00e9s de un nombre de cuenta."
}
],
"id": "CVE-2013-2161",
"lastModified": "2024-11-21T01:51:09.743",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-08-20T22:55:04.057",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://lists.opensuse.org/opensuse-updates/2013-07/msg00021.html"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0993.html"
},
{
"source": "secalert@redhat.com",
"url": "http://www.debian.org/security/2012/dsa-2737"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2013/06/13/4"
},
{
"source": "secalert@redhat.com",
"url": "https://bugs.launchpad.net/swift/+bug/1183884"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2013-07/msg00021.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0993.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.debian.org/security/2012/dsa-2737"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2013/06/13/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugs.launchpad.net/swift/+bug/1183884"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-11-05 20:55
Modified
2024-11-21 01:55
Severity ?
Summary
The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openstack:havana:*:*:*:*:*:*:*:*",
"matchCriteriaId": "6D92E64B-9490-4A19-8EE2-98B46E5C3A32",
"versionEndIncluding": "havana-3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:havana:havana-1:*:*:*:*:*:*:*",
"matchCriteriaId": "45762277-1BC6-4552-B5AB-756AE8D9F543",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:havana:havana-2:*:*:*:*:*:*:*",
"matchCriteriaId": "588B9906-F0A0-4109-94D9-11481135ED06",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openstack:grizzly:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A83ED744-9E3D-4510-B3E6-6DDE1090F0B7",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openstack:folsom:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F5BA13BC-F088-45AA-AD10-B74F89CE5375",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions."
},
{
"lang": "es",
"value": "El backend XenAPI en OpenStack Compute (Nova) Folsom, Grizzly, y Habana anterior a 2013.2 no se aplica correctamente los grupos de seguridad (1) al cambiar el tama\u00f1o de una imagen o (2) durante la migraci\u00f3n en tiempo real, lo que permite a atacantes remotos evitar las restricciones previstas."
}
],
"id": "CVE-2013-4497",
"lastModified": "2024-11-21T01:55:41.200",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-11-05T20:55:29.633",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2013/11/03/2"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2013/11/03/3"
},
{
"source": "secalert@redhat.com",
"url": "https://bugs.launchpad.net/nova/+bug/1073306"
},
{
"source": "secalert@redhat.com",
"url": "https://bugs.launchpad.net/nova/+bug/1202266"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2013/11/03/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2013/11/03/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugs.launchpad.net/nova/+bug/1073306"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugs.launchpad.net/nova/+bug/1202266"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-01-07 18:55
Modified
2024-11-21 01:59
Severity ?
Summary
Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openstack:havana:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FAD8C1D9-5559-49D2-9846-F85ADADA1191",
"versionEndIncluding": "havana-1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron."
},
{
"lang": "es",
"value": "Error de interacci\u00f3n en OpenStack Nova y Neutron anteriores a Havana 2013.2.1 e icehouse-1 no valida el ID de la instancia del inquilino haciendo una petici\u00f3n, lo cual permite a inquilinos remotos obtener metadatos sensibles falseando el ID del dispositivo ligado a un puerto, lo cual no es manejado adecuadamente por (1) api/metadata/handler.py en Nova y (2) el neutron-metadata-agent (agent/metadata/agent.py) en Neutron."
}
],
"id": "CVE-2013-6419",
"lastModified": "2024-11-21T01:59:11.293",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-01-07T18:55:06.957",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0091.html"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0231.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2013/12/11/8"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/64250"
},
{
"source": "secalert@redhat.com",
"url": "https://bugs.launchpad.net/neutron/+bug/1235450"
},
{
"source": "secalert@redhat.com",
"url": "https://review.openstack.org/#/c/61428/2/nova/api/metadata/handler.py"
},
{
"source": "secalert@redhat.com",
"url": "https://review.openstack.org/#/c/61439/1/neutron/agent/metadata/agent.py"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0091.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0231.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2013/12/11/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/64250"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugs.launchpad.net/neutron/+bug/1235450"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://review.openstack.org/#/c/61428/2/nova/api/metadata/handler.py"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://review.openstack.org/#/c/61439/1/neutron/agent/metadata/agent.py"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-11-02 18:55
Modified
2024-11-21 01:55
Severity ?
Summary
OpenStack Compute (Nova) Folsom, Grizzly, and Havana, when use_cow_images is set to False, does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by transferring an image with a large virtual size that does not contain a large amount of data from Glance. NOTE: this issue is due to an incomplete fix for CVE-2013-2096.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openstack:folsom:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F5BA13BC-F088-45AA-AD10-B74F89CE5375",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:grizzly:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A83ED744-9E3D-4510-B3E6-6DDE1090F0B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:havana:-:*:*:*:*:*:*:*",
"matchCriteriaId": "77522028-683C-4708-AF46-50B49A0A2D15",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "OpenStack Compute (Nova) Folsom, Grizzly, and Havana, when use_cow_images is set to False, does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by transferring an image with a large virtual size that does not contain a large amount of data from Glance. NOTE: this issue is due to an incomplete fix for CVE-2013-2096."
},
{
"lang": "es",
"value": "OpenStack Compute (Nova) Folsom, Grizzly, y Habana, cuando use_cow_images se establece como False, no verifica el tama\u00f1o virtual de una imagen qcow2, que permite a usuarios locales provocar una denegaci\u00f3n de servicio (consumo de disco del sistema de archivos host) mediante la transferencia de una imagen con un tama\u00f1o virtual grande que no contiene una gran cantidad de datos desde Glance. NOTA: este problema se debe a una correcci\u00f3n incompleta de CVE-2013-2096."
}
],
"id": "CVE-2013-4469",
"lastModified": "2024-11-21T01:55:37.780",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 1.9,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 3.4,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-11-02T18:55:03.237",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2013/10/31/3"
},
{
"source": "secalert@redhat.com",
"url": "http://www.ubuntu.com/usn/USN-2247-1"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit"
],
"url": "https://bugs.launchpad.net/nova/+bug/1206081"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2013/10/31/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-2247-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://bugs.launchpad.net/nova/+bug/1206081"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-399"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-12-27 01:55
Modified
2024-11-21 01:50
Severity ?
Summary
keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openstack:compute:2013.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6DE1DE9A-0D08-448B-AF80-7ACA236F2A83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:compute:2013.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A5AAEB-0A8F-4ECF-B184-6A78B882817A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:compute:2013.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E8596FDB-87DD-4D06-9923-75EFE7E3F9A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:compute:2013.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FA06A9A5-0924-4137-85AF-DB9C7C246DAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:folsom:-:*:*:*:*:*:*:*",
"matchCriteriaId": "F5BA13BC-F088-45AA-AD10-B74F89CE5375",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:grizzly:2013.1:*:*:*:*:*:*:*",
"matchCriteriaId": "53AAF5DD-EB6C-4EB8-874B-949D74B34179",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:havana:havana-1:*:*:*:*:*:*:*",
"matchCriteriaId": "45762277-1BC6-4552-B5AB-756AE8D9F543",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:havana:havana-2:*:*:*:*:*:*:*",
"matchCriteriaId": "588B9906-F0A0-4109-94D9-11481135ED06",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:havana:havana-3:*:*:*:*:*:*:*",
"matchCriteriaId": "0C6D7CB3-7FFB-4F2C-80A8-9568D3868EB6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora."
},
{
"lang": "es",
"value": "keystone/middleware/auth_token.py en OpenStack Nova Folsom, Grizzly, y Havana, utiliza un directorio temporal inseguro para almacenar certificados de firma, lo cual permite a usuarios locales impersonar servidores mediante la creaci\u00f3n previa de este directorio, que es reutilizado por Nova, como se muestra utilizando /tmp/keystone-signing-nova en Fedora."
}
],
"id": "CVE-2013-2030",
"lastModified": "2024-11-21T01:50:53.797",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "LOW",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 3.9,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-12-27T01:55:05.237",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.html"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2013/05/09/2"
},
{
"source": "secalert@redhat.com",
"url": "https://bugs.launchpad.net/nova/+bug/1174608"
},
{
"source": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=958285"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2013/05/09/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugs.launchpad.net/nova/+bug/1174608"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=958285"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2013-09-16 19:14
Modified
2024-11-21 01:55
Severity ?
Summary
The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openstack:havana:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E4A0404D-6B8B-44D6-8E32-0CEA219D6003",
"versionEndIncluding": "havana-2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:havana:havana-1:*:*:*:*:*:*:*",
"matchCriteriaId": "45762277-1BC6-4552-B5AB-756AE8D9F543",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openstack:compute:2013.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FA06A9A5-0924-4137-85AF-DB9C7C246DAC",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664."
},
{
"lang": "es",
"value": "La extensi\u00f3n de grupos de seguridad en OpenStack Compute (Nova) Grizzly 2013.1.3, Havana anteriores a havana-3, y anteriores, permite a atacantes remotos causar una denegaci\u00f3n de servicio (consumo de recursos y ca\u00edda) a trav\u00e9s de un ataque XML Entity Expansion (XEE). NOTA: este problema es debido a una soluci\u00f3n incompleta para CVE-2013-1664."
}
],
"id": "CVE-2013-4179",
"lastModified": "2024-11-21T01:55:04.337",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-09-16T19:14:38.537",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1199.html"
},
{
"source": "secalert@redhat.com",
"url": "http://www.ubuntu.com/usn/USN-2005-1"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit"
],
"url": "https://bugs.launchpad.net/ossa/+bug/1190229"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1199.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-2005-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit"
],
"url": "https://bugs.launchpad.net/ossa/+bug/1190229"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-119"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2014-02-06 17:00
Modified
2024-11-21 02:00
Severity ?
Summary
The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openstack:compute:2012.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0E9D8029-F7DD-435D-B4F4-D3DABDB7333B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:compute:2013.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6DE1DE9A-0D08-448B-AF80-7ACA236F2A83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:compute:2013.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A1A5AAEB-0A8F-4ECF-B184-6A78B882817A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:compute:2013.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "E8596FDB-87DD-4D06-9923-75EFE7E3F9A0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:compute:2013.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "FA06A9A5-0924-4137-85AF-DB9C7C246DAC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:grizzly:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A83ED744-9E3D-4510-B3E6-6DDE1090F0B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:havana:-:*:*:*:*:*:*:*",
"matchCriteriaId": "77522028-683C-4708-AF46-50B49A0A2D15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:openstack:icehouse:-:*:*:*:*:*:*:*",
"matchCriteriaId": "FC112BBD-F3D2-4192-B11A-B99D54B08D99",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage."
},
{
"lang": "es",
"value": "El m\u00e9todo i_create_images_and_backing (tambi\u00e9n conocido como create_images_and_backing) en el driver libvirt en OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, cuando hace uso de un bloque de migraci\u00f3n KVM en vivo, no crea debidamente todos los archivos esperados, lo que permite a atacantes obtener contenido de una instant\u00e1nea del disco ra\u00edz de otros usuarios a trav\u00e9s del almacenamiento ef\u00edmero."
}
],
"id": "CVE-2013-7130",
"lastModified": "2024-11-21T02:00:23.563",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 6.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2014-02-06T17:00:06.977",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.html"
},
{
"source": "cve@mitre.org",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127735.html"
},
{
"source": "cve@mitre.org",
"url": "http://osvdb.org/102416"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0231.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/56450"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2014/01/23/5"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/65106"
},
{
"source": "cve@mitre.org",
"url": "http://www.ubuntu.com/usn/USN-2247-1"
},
{
"source": "cve@mitre.org",
"url": "https://bugs.launchpad.net/nova/+bug/1251590"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90652"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://review.openstack.org/#/c/68658/"
},
{
"source": "cve@mitre.org",
"url": "https://review.openstack.org/#/c/68659/"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch"
],
"url": "https://review.openstack.org/#/c/68660/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127735.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://osvdb.org/102416"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0231.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/56450"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2014/01/23/5"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/65106"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-2247-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://bugs.launchpad.net/nova/+bug/1251590"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90652"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://review.openstack.org/#/c/68658/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://review.openstack.org/#/c/68659/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch"
],
"url": "https://review.openstack.org/#/c/68660/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-200"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
cve-2013-4179
Vulnerability from cvelistv5
Published
2013-09-16 19:00
Modified
2024-08-06 16:38
Severity ?
EPSS score ?
Summary
The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.
References
| ▼ | URL | Tags |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2013-1199.html | vendor-advisory, x_refsource_REDHAT | |
| https://bugs.launchpad.net/ossa/+bug/1190229 | x_refsource_CONFIRM | |
| http://www.ubuntu.com/usn/USN-2005-1 | vendor-advisory, x_refsource_UBUNTU |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:38:00.185Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "RHSA-2013:1199",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1199.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.launchpad.net/ossa/+bug/1190229"
},
{
"name": "USN-2005-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2005-1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-08-08T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-10-30T09:00:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2013:1199",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1199.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.launchpad.net/ossa/+bug/1190229"
},
{
"name": "USN-2005-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2005-1"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-4179",
"datePublished": "2013-09-16T19:00:00",
"dateReserved": "2013-06-12T00:00:00",
"dateUpdated": "2024-08-06T16:38:00.185Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-2096
Vulnerability from cvelistv5
Published
2013-07-09 17:00
Modified
2024-08-06 15:27
Severity ?
EPSS score ?
Summary
OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by creating an image with a large virtual size that does not contain a large amount of data.
References
| ▼ | URL | Tags |
|---|---|---|
| https://review.openstack.org/#/c/28717/ | x_refsource_CONFIRM | |
| https://review.openstack.org/#/c/28901/ | x_refsource_CONFIRM | |
| http://www.ubuntu.com/usn/USN-1831-1 | vendor-advisory, x_refsource_UBUNTU | |
| http://lists.openstack.org/pipermail/openstack-announce/2013-May/000102.html | mailing-list, x_refsource_MLIST | |
| https://review.openstack.org/#/c/29192/ | x_refsource_CONFIRM | |
| http://www.securityfocus.com/bid/59924 | vdb-entry, x_refsource_BID |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:27:40.933Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://review.openstack.org/#/c/28717/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://review.openstack.org/#/c/28901/"
},
{
"name": "USN-1831-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1831-1"
},
{
"name": "[openstack-announce] 20130516 [OSSA 2013-012] Nova fails to verify image virtual size (CVE-2013-2096)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.openstack.org/pipermail/openstack-announce/2013-May/000102.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://review.openstack.org/#/c/29192/"
},
{
"name": "59924",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/59924"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-05-16T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by creating an image with a large virtual size that does not contain a large amount of data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-01-03T22:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://review.openstack.org/#/c/28717/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://review.openstack.org/#/c/28901/"
},
{
"name": "USN-1831-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1831-1"
},
{
"name": "[openstack-announce] 20130516 [OSSA 2013-012] Nova fails to verify image virtual size (CVE-2013-2096)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.openstack.org/pipermail/openstack-announce/2013-May/000102.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://review.openstack.org/#/c/29192/"
},
{
"name": "59924",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/59924"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-2096",
"datePublished": "2013-07-09T17:00:00",
"dateReserved": "2013-02-19T00:00:00",
"dateUpdated": "2024-08-06T15:27:40.933Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-7130
Vulnerability from cvelistv5
Published
2014-02-06 16:00
Modified
2024-08-06 18:01
Severity ?
EPSS score ?
Summary
The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T18:01:19.335Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://review.openstack.org/#/c/68659/"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://review.openstack.org/#/c/68658/"
},
{
"name": "65106",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/65106"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://review.openstack.org/#/c/68660/"
},
{
"name": "openstack-cve20137130-info-disc(90652)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90652"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugs.launchpad.net/nova/+bug/1251590"
},
{
"name": "56450",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/56450"
},
{
"name": "102416",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/102416"
},
{
"name": "USN-2247-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2247-1"
},
{
"name": "RHSA-2014:0231",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0231.html"
},
{
"name": "[oss-security] 20140124 [OSSA 2014-003] Live migration can leak root disk into ephemeral storage (CVE-2013-7130)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2014/01/23/5"
},
{
"name": "FEDORA-2014-1463",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.html"
},
{
"name": "FEDORA-2014-1516",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127735.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-01-24T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://review.openstack.org/#/c/68659/"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://review.openstack.org/#/c/68658/"
},
{
"name": "65106",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/65106"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://review.openstack.org/#/c/68660/"
},
{
"name": "openstack-cve20137130-info-disc(90652)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90652"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugs.launchpad.net/nova/+bug/1251590"
},
{
"name": "56450",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/56450"
},
{
"name": "102416",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/102416"
},
{
"name": "USN-2247-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2247-1"
},
{
"name": "RHSA-2014:0231",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0231.html"
},
{
"name": "[oss-security] 20140124 [OSSA 2014-003] Live migration can leak root disk into ephemeral storage (CVE-2013-7130)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2014/01/23/5"
},
{
"name": "FEDORA-2014-1463",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.html"
},
{
"name": "FEDORA-2014-1516",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127735.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-7130",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://review.openstack.org/#/c/68659/",
"refsource": "CONFIRM",
"url": "https://review.openstack.org/#/c/68659/"
},
{
"name": "https://review.openstack.org/#/c/68658/",
"refsource": "CONFIRM",
"url": "https://review.openstack.org/#/c/68658/"
},
{
"name": "65106",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/65106"
},
{
"name": "https://review.openstack.org/#/c/68660/",
"refsource": "CONFIRM",
"url": "https://review.openstack.org/#/c/68660/"
},
{
"name": "openstack-cve20137130-info-disc(90652)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/90652"
},
{
"name": "https://bugs.launchpad.net/nova/+bug/1251590",
"refsource": "MISC",
"url": "https://bugs.launchpad.net/nova/+bug/1251590"
},
{
"name": "56450",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/56450"
},
{
"name": "102416",
"refsource": "OSVDB",
"url": "http://osvdb.org/102416"
},
{
"name": "USN-2247-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/USN-2247-1"
},
{
"name": "RHSA-2014:0231",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0231.html"
},
{
"name": "[oss-security] 20140124 [OSSA 2014-003] Live migration can leak root disk into ephemeral storage (CVE-2013-7130)",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2014/01/23/5"
},
{
"name": "FEDORA-2014-1463",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.html"
},
{
"name": "FEDORA-2014-1516",
"refsource": "FEDORA",
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127735.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-7130",
"datePublished": "2014-02-06T16:00:00",
"dateReserved": "2013-12-17T00:00:00",
"dateUpdated": "2024-08-06T18:01:19.335Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-2161
Vulnerability from cvelistv5
Published
2013-08-20 22:00
Modified
2024-08-06 15:27
Severity ?
EPSS score ?
Summary
XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofed Swift responses via an account name.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.debian.org/security/2012/dsa-2737 | vendor-advisory, x_refsource_DEBIAN | |
| http://lists.opensuse.org/opensuse-updates/2013-07/msg00021.html | vendor-advisory, x_refsource_SUSE | |
| https://bugs.launchpad.net/swift/+bug/1183884 | x_refsource_CONFIRM | |
| http://rhn.redhat.com/errata/RHSA-2013-0993.html | vendor-advisory, x_refsource_REDHAT | |
| http://www.openwall.com/lists/oss-security/2013/06/13/4 | mailing-list, x_refsource_MLIST |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:27:40.947Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "DSA-2737",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2737"
},
{
"name": "openSUSE-SU-2013:1146",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-07/msg00021.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.launchpad.net/swift/+bug/1183884"
},
{
"name": "RHSA-2013:0993",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0993.html"
},
{
"name": "[oss-security] 20130613 [OSSA 2013-016] Unchecked user input in Swift XML responses (CVE-2013-2161)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/06/13/4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and Havana allows attackers to trigger invalid or spoofed Swift responses via an account name."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-08-20T22:00:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "DSA-2737",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2737"
},
{
"name": "openSUSE-SU-2013:1146",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-07/msg00021.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.launchpad.net/swift/+bug/1183884"
},
{
"name": "RHSA-2013:0993",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0993.html"
},
{
"name": "[oss-security] 20130613 [OSSA 2013-016] Unchecked user input in Swift XML responses (CVE-2013-2161)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/06/13/4"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-2161",
"datePublished": "2013-08-20T22:00:00Z",
"dateReserved": "2013-02-19T00:00:00Z",
"dateUpdated": "2024-08-06T15:27:40.947Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-6419
Vulnerability from cvelistv5
Published
2014-01-07 18:00
Modified
2024-08-06 17:39
Severity ?
EPSS score ?
Summary
Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.securityfocus.com/bid/64250 | vdb-entry, x_refsource_BID | |
| https://review.openstack.org/#/c/61428/2/nova/api/metadata/handler.py | x_refsource_MISC | |
| http://rhn.redhat.com/errata/RHSA-2014-0091.html | vendor-advisory, x_refsource_REDHAT | |
| http://rhn.redhat.com/errata/RHSA-2014-0231.html | vendor-advisory, x_refsource_REDHAT | |
| http://www.openwall.com/lists/oss-security/2013/12/11/8 | mailing-list, x_refsource_MLIST | |
| https://review.openstack.org/#/c/61439/1/neutron/agent/metadata/agent.py | x_refsource_MISC | |
| https://bugs.launchpad.net/neutron/+bug/1235450 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T17:39:01.179Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "64250",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/64250"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://review.openstack.org/#/c/61428/2/nova/api/metadata/handler.py"
},
{
"name": "RHSA-2014:0091",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0091.html"
},
{
"name": "RHSA-2014:0231",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0231.html"
},
{
"name": "[oss-security] 20131211 [OSSA 2013-033] Metadata queries from Neutron to Nova are not restricted by tenant (CVE-2013-6419)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/12/11/8"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://review.openstack.org/#/c/61439/1/neutron/agent/metadata/agent.py"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.launchpad.net/neutron/+bug/1235450"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-12-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-03-06T14:57:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "64250",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/64250"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://review.openstack.org/#/c/61428/2/nova/api/metadata/handler.py"
},
{
"name": "RHSA-2014:0091",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0091.html"
},
{
"name": "RHSA-2014:0231",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0231.html"
},
{
"name": "[oss-security] 20131211 [OSSA 2013-033] Metadata queries from Neutron to Nova are not restricted by tenant (CVE-2013-6419)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/12/11/8"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://review.openstack.org/#/c/61439/1/neutron/agent/metadata/agent.py"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.launchpad.net/neutron/+bug/1235450"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-6419",
"datePublished": "2014-01-07T18:00:00",
"dateReserved": "2013-11-04T00:00:00",
"dateUpdated": "2024-08-06T17:39:01.179Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-4477
Vulnerability from cvelistv5
Published
2013-11-02 19:00
Modified
2024-08-06 16:45
Severity ?
EPSS score ?
Summary
The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2013/10/30/6 | mailing-list, x_refsource_MLIST | |
| http://www.ubuntu.com/usn/USN-2034-1 | vendor-advisory, x_refsource_UBUNTU | |
| http://rhn.redhat.com/errata/RHSA-2014-0113.html | vendor-advisory, x_refsource_REDHAT | |
| https://bugs.launchpad.net/keystone/+bug/1242855 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:45:14.815Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20131030 [OSSA 2013-028] Unintentional role granting with Keystone LDAP backend (CVE-2013-4477)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/10/30/6"
},
{
"name": "USN-2034-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2034-1"
},
{
"name": "RHSA-2014:0113",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0113.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.launchpad.net/keystone/+bug/1242855"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-10-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-02-28T14:57:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[oss-security] 20131030 [OSSA 2013-028] Unintentional role granting with Keystone LDAP backend (CVE-2013-4477)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/10/30/6"
},
{
"name": "USN-2034-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2034-1"
},
{
"name": "RHSA-2014:0113",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0113.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.launchpad.net/keystone/+bug/1242855"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-4477",
"datePublished": "2013-11-02T19:00:00",
"dateReserved": "2013-06-12T00:00:00",
"dateUpdated": "2024-08-06T16:45:14.815Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-4463
Vulnerability from cvelistv5
Published
2014-02-06 02:00
Modified
2024-08-06 16:45
Severity ?
EPSS score ?
Summary
OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) via a compressed QCOW2 image. NOTE: this issue is due to an incomplete fix for CVE-2013-2096.
References
| ▼ | URL | Tags |
|---|---|---|
| https://bugs.launchpad.net/nova/+bug/1206081 | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2013/10/31/3 | mailing-list, x_refsource_MLIST | |
| http://www.ubuntu.com/usn/USN-2247-1 | vendor-advisory, x_refsource_UBUNTU | |
| http://rhn.redhat.com/errata/RHSA-2014-0112.html | vendor-advisory, x_refsource_REDHAT |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:45:14.837Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.launchpad.net/nova/+bug/1206081"
},
{
"name": "[oss-security] 20131031 [OSSA 2013-029] Potential Nova denial of service through compressed disk images (CVE-2013-4463, CVE-2013-4469)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/10/31/3"
},
{
"name": "USN-2247-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2247-1"
},
{
"name": "RHSA-2014:0112",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0112.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-10-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) via a compressed QCOW2 image. NOTE: this issue is due to an incomplete fix for CVE-2013-2096."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-06-19T14:57:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.launchpad.net/nova/+bug/1206081"
},
{
"name": "[oss-security] 20131031 [OSSA 2013-029] Potential Nova denial of service through compressed disk images (CVE-2013-4463, CVE-2013-4469)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/10/31/3"
},
{
"name": "USN-2247-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2247-1"
},
{
"name": "RHSA-2014:0112",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0112.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-4463",
"datePublished": "2014-02-06T02:00:00",
"dateReserved": "2013-06-12T00:00:00",
"dateUpdated": "2024-08-06T16:45:14.837Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-4155
Vulnerability from cvelistv5
Published
2013-08-20 22:00
Modified
2024-08-06 16:30
Severity ?
EPSS score ?
Summary
OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service ("superfluous" tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp that is older than expected.
References
| ▼ | URL | Tags |
|---|---|---|
| https://bugs.launchpad.net/swift/+bug/1196932 | x_refsource_CONFIRM | |
| http://www.debian.org/security/2012/dsa-2737 | vendor-advisory, x_refsource_DEBIAN | |
| https://review.openstack.org/#/c/40646/ | x_refsource_MISC | |
| http://www.openwall.com/lists/oss-security/2013/08/07/6 | mailing-list, x_refsource_MLIST | |
| http://www.ubuntu.com/usn/USN-2001-1 | vendor-advisory, x_refsource_UBUNTU | |
| https://review.openstack.org/#/c/40645/ | x_refsource_MISC | |
| https://review.openstack.org/#/c/40643/ | x_refsource_MISC | |
| http://rhn.redhat.com/errata/RHSA-2013-1197.html | vendor-advisory, x_refsource_REDHAT |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:30:50.054Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.launchpad.net/swift/+bug/1196932"
},
{
"name": "DSA-2737",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2012/dsa-2737"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://review.openstack.org/#/c/40646/"
},
{
"name": "[oss-security] 20130807 [OSSA 2013-022] Swift Denial of Service using superfluous object tombstones (CVE-2013-4155)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/08/07/6"
},
{
"name": "USN-2001-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2001-1"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://review.openstack.org/#/c/40645/"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://review.openstack.org/#/c/40643/"
},
{
"name": "RHSA-2013:1197",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1197.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-06-13T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to cause a denial of service (\"superfluous\" tombstone consumption and Swift cluster slowdown) via a DELETE request with a timestamp that is older than expected."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-09-12T09:00:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.launchpad.net/swift/+bug/1196932"
},
{
"name": "DSA-2737",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2012/dsa-2737"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://review.openstack.org/#/c/40646/"
},
{
"name": "[oss-security] 20130807 [OSSA 2013-022] Swift Denial of Service using superfluous object tombstones (CVE-2013-4155)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/08/07/6"
},
{
"name": "USN-2001-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2001-1"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://review.openstack.org/#/c/40645/"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://review.openstack.org/#/c/40643/"
},
{
"name": "RHSA-2013:1197",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1197.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-4155",
"datePublished": "2013-08-20T22:00:00",
"dateReserved": "2013-06-12T00:00:00",
"dateUpdated": "2024-08-06T16:30:50.054Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-2030
Vulnerability from cvelistv5
Published
2013-12-27 01:00
Modified
2024-08-06 15:20
Severity ?
EPSS score ?
Summary
keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2013/05/09/2 | mailing-list, x_refsource_MLIST | |
| http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html | vendor-advisory, x_refsource_FEDORA | |
| http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.html | mailing-list, x_refsource_MLIST | |
| https://bugs.launchpad.net/nova/+bug/1174608 | x_refsource_CONFIRM | |
| https://bugzilla.redhat.com/show_bug.cgi?id=958285 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T15:20:37.504Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20130509 [OSSA 2013-010] Nova uses insecure keystone middleware tmpdir by default (CVE-2013-2030)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/05/09/2"
},
{
"name": "FEDORA-2013-8048",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html"
},
{
"name": "[openstack-announce] 20130509 [OSSA 2013-010] Nova uses insecure keystone middleware tmpdir by default (CVE-2013-2030)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.launchpad.net/nova/+bug/1174608"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=958285"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-05-09T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-04-26T23:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[oss-security] 20130509 [OSSA 2013-010] Nova uses insecure keystone middleware tmpdir by default (CVE-2013-2030)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/05/09/2"
},
{
"name": "FEDORA-2013-8048",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html"
},
{
"name": "[openstack-announce] 20130509 [OSSA 2013-010] Nova uses insecure keystone middleware tmpdir by default (CVE-2013-2030)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.launchpad.net/nova/+bug/1174608"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=958285"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-2030",
"datePublished": "2013-12-27T01:00:00",
"dateReserved": "2013-02-19T00:00:00",
"dateUpdated": "2024-08-06T15:20:37.504Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-4469
Vulnerability from cvelistv5
Published
2013-11-02 18:00
Modified
2024-08-06 16:45
Severity ?
EPSS score ?
Summary
OpenStack Compute (Nova) Folsom, Grizzly, and Havana, when use_cow_images is set to False, does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by transferring an image with a large virtual size that does not contain a large amount of data from Glance. NOTE: this issue is due to an incomplete fix for CVE-2013-2096.
References
| ▼ | URL | Tags |
|---|---|---|
| https://bugs.launchpad.net/nova/+bug/1206081 | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2013/10/31/3 | mailing-list, x_refsource_MLIST | |
| http://www.ubuntu.com/usn/USN-2247-1 | vendor-advisory, x_refsource_UBUNTU |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:45:14.301Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.launchpad.net/nova/+bug/1206081"
},
{
"name": "[oss-security] 20131031 [OSSA 2013-029] Potential Nova denial of service through compressed disk images (CVE-2013-4463, CVE-2013-4469)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/10/31/3"
},
{
"name": "USN-2247-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2247-1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-10-31T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "OpenStack Compute (Nova) Folsom, Grizzly, and Havana, when use_cow_images is set to False, does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by transferring an image with a large virtual size that does not contain a large amount of data from Glance. NOTE: this issue is due to an incomplete fix for CVE-2013-2096."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-06-19T14:57:00",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.launchpad.net/nova/+bug/1206081"
},
{
"name": "[oss-security] 20131031 [OSSA 2013-029] Potential Nova denial of service through compressed disk images (CVE-2013-4463, CVE-2013-4469)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/10/31/3"
},
{
"name": "USN-2247-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2247-1"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-4469",
"datePublished": "2013-11-02T18:00:00",
"dateReserved": "2013-06-12T00:00:00",
"dateUpdated": "2024-08-06T16:45:14.301Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2013-4497
Vulnerability from cvelistv5
Published
2013-11-05 20:00
Modified
2024-08-06 16:45
Severity ?
EPSS score ?
Summary
The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions.
References
| ▼ | URL | Tags |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2013/11/03/2 | mailing-list, x_refsource_MLIST | |
| https://bugs.launchpad.net/nova/+bug/1202266 | x_refsource_CONFIRM | |
| http://www.openwall.com/lists/oss-security/2013/11/03/3 | mailing-list, x_refsource_MLIST | |
| https://bugs.launchpad.net/nova/+bug/1073306 | x_refsource_CONFIRM |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T16:45:14.926Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[oss-security] 20131103 CVE request for a vulnerability in OpenStack Nova",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/11/03/2"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.launchpad.net/nova/+bug/1202266"
},
{
"name": "[oss-security] 20131103 Re: CVE request for a vulnerability in OpenStack Nova",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/11/03/3"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.launchpad.net/nova/+bug/1073306"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-11-05T20:00:00Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[oss-security] 20131103 CVE request for a vulnerability in OpenStack Nova",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/11/03/2"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.launchpad.net/nova/+bug/1202266"
},
{
"name": "[oss-security] 20131103 Re: CVE request for a vulnerability in OpenStack Nova",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/11/03/3"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.launchpad.net/nova/+bug/1073306"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-4497",
"datePublished": "2013-11-05T20:00:00Z",
"dateReserved": "2013-06-12T00:00:00Z",
"dateUpdated": "2024-08-06T16:45:14.926Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}