PT-2013-3422 · Openstack · Openstack Compute

Publicado 2013-03-22 · Atualizado 2022-05-17 · CVE-2013-1838

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions Grizzly, Folsom (2012.2), Essex (2012.1)

Description The issue allows remote authenticated users to cause a denial of service, resulting in resource exhaustion and failure to spawn new instances, by making a large number of calls to the addFixedIp function. This is due to the improper implementation of a quota for fixed IPs.

Recommendations For OpenStack Compute (Nova) versions Grizzly, Folsom (2012.2), Essex (2012.1), consider restricting access to the addFixedIp function to prevent excessive calls and mitigate the risk of resource exhaustion.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

CWE-399

Identificadores relacionados

CVE-2013-1838

GHSA-63FQ-8FP9-VHWQ

PYSEC-2013-44

RHSA-2013:0709

Produtos afetados

Openstack Compute

Referências · 25

• https://github.com/openstack/nova · Nota
• https://github.com/openstack/nova/commit/9561484166f245d0e4602a36351d6cac72dd9426 · Nota
• https://github.com/openstack/nova/commit/efaacdaee116388234558e2682b647d41fe5b149 · Nota
• https://github.com/openstack/nova/commit/99429214d4ddb5bdc7de185693b8a53ad50df3c6 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2013-44.yaml · Nota
• https://review.openstack.org/#/c/24452 · Nota
• https://review.openstack.org/#/c/24453 · Nota
• https://osv.dev/vulnerability/GHSA-63fq-8fp9-vhwq · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=919648 · Nota
• http://rhn.redhat.com/errata/RHSA-2013-0709.html · Aviso do Fabricante
• http://secunia.com/advisories/52580 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2013-1838 · Aviso do Fabricante
• http://secunia.com/advisories/52728 · Aviso do Fabricante
• https://review.openstack.org/#/c/24451 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82877 · Nota