RHSA-2014:0112
Vulnerability from csaf_redhat
Published
2014-01-30 19:58
Modified
2024-11-22 07:25
Summary
Red Hat Security Advisory: openstack-nova security and bug fix update

Notes

Topic
Updated openstack-nova packages that fix two security issues and three bugs are now available for Red Hat Enterprise Linux OpenStack Platform 3.0. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Details
The openstack-nova packages provide OpenStack Compute (nova), which provides services for provisioning, managing, and using virtual machine instances. It was discovered that enabling "qpid_protocol = ssl" in the nova.conf file did not result in nova using SSL to communicate to Qpid. If Qpid was not configured to enforce SSL this could lead to sensitive information being sent unencrypted over the communication channel. (CVE-2013-6491) A flaw was found in the way OpenStack Compute controlled the size of disk images. An authenticated remote user could use malicious compressed qcow2 disk images to consume large amounts of disk space, potentially causing a denial of service on the OpenStack Compute nodes. (CVE-2013-4463) Red Hat would like to thank the OpenStack project for reporting CVE-2013-4463. Upstream acknowledges Bernhard M. Wiedemann of SuSE as the original reporter of this issue. This update also fixes the following bugs: * When using GroupAntiAffinityFilter, the scheduler was not filtering instances in the group, which could cause an instance to not be scheduled at all if a group was specified on boot. With this fix, groups are taken into account and the instance is scheduled as expected. (BZ#1014948) * If an exchange had not been created previously by a consumer, the publisher would crash because it could not find the specified exchange. This resulted from Qpid's direct publisher using the wrong exchange type 'Direct'. With this fix, the exchange type in the publisher has been changed to 'direct'. (BZ#1042055) * Unhandled errors in the Qpid consuming thread could kill it silently and isolate the component from the rest of the system. To fix this, the consuming thread has been made more resilient to errors by ensuring it does not die on an unhandled error. Compute now logs the error and retries the consuming thread. (BZ#1050213) All openstack-nova users are advised to upgrade to these updated packages, which contain backported patches to correct these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated openstack-nova packages that fix two security issues and three bugs\nare now available for Red Hat Enterprise Linux OpenStack Platform 3.0.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The openstack-nova packages provide OpenStack Compute (nova), which\nprovides services for provisioning, managing, and using virtual\nmachine instances.\n\nIt was discovered that enabling \"qpid_protocol = ssl\" in the nova.conf file\ndid not result in nova using SSL to communicate to Qpid. If Qpid was not\nconfigured to enforce SSL this could lead to sensitive information being\nsent unencrypted over the communication channel. (CVE-2013-6491)\n\nA flaw was found in the way OpenStack Compute controlled the size of disk\nimages. An authenticated remote user could use malicious compressed qcow2\ndisk images to consume large amounts of disk space, potentially causing a\ndenial of service on the OpenStack Compute nodes. (CVE-2013-4463)\n\nRed Hat would like to thank the OpenStack project for reporting\nCVE-2013-4463. Upstream acknowledges Bernhard M. Wiedemann of SuSE as the\noriginal reporter of this issue.\n\nThis update also fixes the following bugs:\n\n* When using GroupAntiAffinityFilter, the scheduler was not filtering\ninstances in the group, which could cause an instance to not be scheduled\nat all if a group was specified on boot. With this fix, groups are taken\ninto account and the instance is scheduled as expected. (BZ#1014948)\n\n* If an exchange had not been created previously by a consumer, the\npublisher would crash because it could not find the specified exchange.\nThis resulted from Qpid\u0027s direct publisher using the wrong exchange type\n\u0027Direct\u0027. With this fix, the exchange type in the publisher has been\nchanged to \u0027direct\u0027. (BZ#1042055)\n\n* Unhandled errors in the Qpid consuming thread could kill it silently and\nisolate the component from the rest of the system. To fix this, the\nconsuming thread has been made more resilient to errors by ensuring it does\nnot die on an unhandled error. Compute now logs the error and retries the\nconsuming thread. (BZ#1050213)\n\nAll openstack-nova users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct these issues.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2014:0112",
        "url": "https://access.redhat.com/errata/RHSA-2014:0112"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "996766",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=996766"
      },
      {
        "category": "external",
        "summary": "1014948",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1014948"
      },
      {
        "category": "external",
        "summary": "1023239",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1023239"
      },
      {
        "category": "external",
        "summary": "1044562",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1044562"
      },
      {
        "category": "external",
        "summary": "1050213",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1050213"
      },
      {
        "category": "external",
        "summary": "1059504",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1059504"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0112.json"
      }
    ],
    "title": "Red Hat Security Advisory: openstack-nova security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-22T07:25:48+00:00",
      "generator": {
        "date": "2024-11-22T07:25:48+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2014:0112",
      "initial_release_date": "2014-01-30T19:58:47+00:00",
      "revision_history": [
        {
          "date": "2014-01-30T19:58:47+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2014-01-30T19:58:47+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T07:25:48+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux OpenStack Platform 3.0",
                "product": {
                  "name": "Red Hat Enterprise Linux OpenStack Platform 3.0",
                  "product_id": "6Server-Grizzly",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openstack:3::el6"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenStack Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-nova-api-0:2013.1.4-4.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-api-0:2013.1.4-4.el6ost.noarch",
                  "product_id": "openstack-nova-api-0:2013.1.4-4.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-api@2013.1.4-4.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch",
                  "product_id": "openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-conductor@2013.1.4-4.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch",
                  "product_id": "openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-scheduler@2013.1.4-4.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-0:2013.1.4-4.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-0:2013.1.4-4.el6ost.noarch",
                  "product_id": "openstack-nova-0:2013.1.4-4.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova@2013.1.4-4.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-cells-0:2013.1.4-4.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-cells-0:2013.1.4-4.el6ost.noarch",
                  "product_id": "openstack-nova-cells-0:2013.1.4-4.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-cells@2013.1.4-4.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-cert-0:2013.1.4-4.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-cert-0:2013.1.4-4.el6ost.noarch",
                  "product_id": "openstack-nova-cert-0:2013.1.4-4.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-cert@2013.1.4-4.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-console-0:2013.1.4-4.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-console-0:2013.1.4-4.el6ost.noarch",
                  "product_id": "openstack-nova-console-0:2013.1.4-4.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-console@2013.1.4-4.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-doc-0:2013.1.4-4.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-doc-0:2013.1.4-4.el6ost.noarch",
                  "product_id": "openstack-nova-doc-0:2013.1.4-4.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-doc@2013.1.4-4.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-network-0:2013.1.4-4.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-network-0:2013.1.4-4.el6ost.noarch",
                  "product_id": "openstack-nova-network-0:2013.1.4-4.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-network@2013.1.4-4.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-compute-0:2013.1.4-4.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-compute-0:2013.1.4-4.el6ost.noarch",
                  "product_id": "openstack-nova-compute-0:2013.1.4-4.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-compute@2013.1.4-4.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-common-0:2013.1.4-4.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-common-0:2013.1.4-4.el6ost.noarch",
                  "product_id": "openstack-nova-common-0:2013.1.4-4.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-common@2013.1.4-4.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-nova-0:2013.1.4-4.el6ost.noarch",
                "product": {
                  "name": "python-nova-0:2013.1.4-4.el6ost.noarch",
                  "product_id": "python-nova-0:2013.1.4-4.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-nova@2013.1.4-4.el6ost?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch",
                "product": {
                  "name": "openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch",
                  "product_id": "openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova-objectstore@2013.1.4-4.el6ost?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openstack-nova-0:2013.1.4-4.el6ost.src",
                "product": {
                  "name": "openstack-nova-0:2013.1.4-4.el6ost.src",
                  "product_id": "openstack-nova-0:2013.1.4-4.el6ost.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/openstack-nova@2013.1.4-4.el6ost?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
          "product_id": "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.noarch"
        },
        "product_reference": "openstack-nova-0:2013.1.4-4.el6ost.noarch",
        "relates_to_product_reference": "6Server-Grizzly"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-0:2013.1.4-4.el6ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
          "product_id": "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.src"
        },
        "product_reference": "openstack-nova-0:2013.1.4-4.el6ost.src",
        "relates_to_product_reference": "6Server-Grizzly"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-api-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
          "product_id": "6Server-Grizzly:openstack-nova-api-0:2013.1.4-4.el6ost.noarch"
        },
        "product_reference": "openstack-nova-api-0:2013.1.4-4.el6ost.noarch",
        "relates_to_product_reference": "6Server-Grizzly"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-cells-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
          "product_id": "6Server-Grizzly:openstack-nova-cells-0:2013.1.4-4.el6ost.noarch"
        },
        "product_reference": "openstack-nova-cells-0:2013.1.4-4.el6ost.noarch",
        "relates_to_product_reference": "6Server-Grizzly"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-cert-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
          "product_id": "6Server-Grizzly:openstack-nova-cert-0:2013.1.4-4.el6ost.noarch"
        },
        "product_reference": "openstack-nova-cert-0:2013.1.4-4.el6ost.noarch",
        "relates_to_product_reference": "6Server-Grizzly"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-common-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
          "product_id": "6Server-Grizzly:openstack-nova-common-0:2013.1.4-4.el6ost.noarch"
        },
        "product_reference": "openstack-nova-common-0:2013.1.4-4.el6ost.noarch",
        "relates_to_product_reference": "6Server-Grizzly"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-compute-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
          "product_id": "6Server-Grizzly:openstack-nova-compute-0:2013.1.4-4.el6ost.noarch"
        },
        "product_reference": "openstack-nova-compute-0:2013.1.4-4.el6ost.noarch",
        "relates_to_product_reference": "6Server-Grizzly"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
          "product_id": "6Server-Grizzly:openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch"
        },
        "product_reference": "openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch",
        "relates_to_product_reference": "6Server-Grizzly"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-console-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
          "product_id": "6Server-Grizzly:openstack-nova-console-0:2013.1.4-4.el6ost.noarch"
        },
        "product_reference": "openstack-nova-console-0:2013.1.4-4.el6ost.noarch",
        "relates_to_product_reference": "6Server-Grizzly"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-doc-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
          "product_id": "6Server-Grizzly:openstack-nova-doc-0:2013.1.4-4.el6ost.noarch"
        },
        "product_reference": "openstack-nova-doc-0:2013.1.4-4.el6ost.noarch",
        "relates_to_product_reference": "6Server-Grizzly"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-network-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
          "product_id": "6Server-Grizzly:openstack-nova-network-0:2013.1.4-4.el6ost.noarch"
        },
        "product_reference": "openstack-nova-network-0:2013.1.4-4.el6ost.noarch",
        "relates_to_product_reference": "6Server-Grizzly"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
          "product_id": "6Server-Grizzly:openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch"
        },
        "product_reference": "openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch",
        "relates_to_product_reference": "6Server-Grizzly"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
          "product_id": "6Server-Grizzly:openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch"
        },
        "product_reference": "openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch",
        "relates_to_product_reference": "6Server-Grizzly"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-nova-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
          "product_id": "6Server-Grizzly:python-nova-0:2013.1.4-4.el6ost.noarch"
        },
        "product_reference": "python-nova-0:2013.1.4-4.el6ost.noarch",
        "relates_to_product_reference": "6Server-Grizzly"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Thierry Carrez"
          ],
          "organization": "OpenStack project"
        },
        {
          "names": [
            "Bernhard M. Wiedemann"
          ],
          "organization": "SuSE",
          "summary": "Acknowledged by upstream."
        }
      ],
      "cve": "CVE-2013-4463",
      "discovery_date": "2013-10-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1023239"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) via a compressed QCOW2 image.  NOTE: this issue is due to an incomplete fix for CVE-2013-2096.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Nova: Compressed disk image DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The Red Hat Security Response Team has rated this issue as having moderate security impact. For  additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.src",
          "6Server-Grizzly:openstack-nova-api-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-cells-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-cert-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-common-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-compute-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-console-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-doc-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-network-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:python-nova-0:2013.1.4-4.el6ost.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-4463"
        },
        {
          "category": "external",
          "summary": "RHBZ#1023239",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1023239"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4463",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-4463"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4463",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4463"
        }
      ],
      "release_date": "2013-10-31T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-01-30T19:58:47+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.src",
            "6Server-Grizzly:openstack-nova-api-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-cells-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-cert-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-common-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-compute-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-console-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-doc-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-network-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:python-nova-0:2013.1.4-4.el6ost.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0112"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 4.0,
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.src",
            "6Server-Grizzly:openstack-nova-api-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-cells-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-cert-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-common-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-compute-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-console-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-doc-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-network-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:python-nova-0:2013.1.4-4.el6ost.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Nova: Compressed disk image DoS"
    },
    {
      "cve": "CVE-2013-6491",
      "discovery_date": "2014-01-29T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1059504"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The python-qpid client (common/rpc/impl_qpid.py) in OpenStack Oslo before 2013.2 does not enforce SSL connections when qpid_protocol is set to ssl, which allows remote attackers to obtain sensitive information by sniffing the network.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "nova: qpid SSL configuration",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.src",
          "6Server-Grizzly:openstack-nova-api-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-cells-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-cert-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-common-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-compute-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-console-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-doc-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-network-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch",
          "6Server-Grizzly:python-nova-0:2013.1.4-4.el6ost.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2013-6491"
        },
        {
          "category": "external",
          "summary": "RHBZ#1059504",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1059504"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2013-6491",
          "url": "https://www.cve.org/CVERecord?id=CVE-2013-6491"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6491",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6491"
        }
      ],
      "release_date": "2013-03-22T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2014-01-30T19:58:47+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
          "product_ids": [
            "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.src",
            "6Server-Grizzly:openstack-nova-api-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-cells-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-cert-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-common-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-compute-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-console-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-doc-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-network-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:python-nova-0:2013.1.4-4.el6ost.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2014:0112"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "HIGH",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.1,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.src",
            "6Server-Grizzly:openstack-nova-api-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-cells-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-cert-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-common-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-compute-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-console-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-doc-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-network-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch",
            "6Server-Grizzly:python-nova-0:2013.1.4-4.el6ost.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "nova: qpid SSL configuration"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.