PT-2013-3539 · Openstack · Openstack Compute

Publicado 2013-07-09 · Atualizado 2022-05-17 · CVE-2013-2096

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Média

Vetor base

AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions Folsom through Havana

Description The issue allows local users to cause a denial of service by creating an image with a large virtual size that does not contain a large amount of data, resulting in host file system disk consumption.

Recommendations For versions Folsom through Havana, consider restricting the creation of QCOW2 images or implementing size verification to prevent excessive disk consumption until a proper fix is applied.

Correção

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

CWE-399

Identificadores relacionados

CVE-2013-2096

GHSA-M674-HMX2-FFHQ

Produtos afetados

Openstack Compute

Referências · 15

• https://github.com/openstack/nova · Nota
• https://github.com/openstack/nova/commit/44a8aba1d5da87d54db48079103fdef946666d80 · Nota
• https://github.com/openstack/nova/commit/0caeb8eaf20abcdc77828f5c6b79fc104619e231 · Nota
• https://web.archive.org/web/20130726040108/http://securityfocus.com/bid/59924 · Nota
• http://securityfocus.com/bid/59924 · Nota
• https://review.openstack.org/#/c/28901 · Nota
• http://lists.openstack.org/pipermail/openstack-announce/2013-May/000102.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-2096 · Nota de Segurança
• https://review.openstack.org/#/c/29192 · Nota
• https://osv.dev/vulnerability/CVE-2013-2096 · Aviso do Fabricante
• http://ubuntu.com/usn/USN-1831-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2096 · Aviso do Fabricante
• https://review.openstack.org/#/c/28717 · Nota
• https://security-tracker.debian.org/tracker/CVE-2013-2096 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-m674-hmx2-ffhq · Aviso do Fabricante