PT-2013-4933 · Openstack · Openstack Compute

Kenichi Ohmichi + 1 · Publicado 2013-09-16 · Atualizado 2023-02-13 · CVE-2013-4278

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions Folsom through Havana

Description The issue is related to the "create an instance" API, which does not properly enforce the os-flavor-access:is public property. This allows remote authenticated users to boot arbitrary flavors by guessing the flavor id.

Recommendations For OpenStack Compute (Nova) versions Folsom through Havana, as a temporary workaround, consider restricting access to the "create an instance" API until a proper fix is applied. Avoid using the os-flavor-access:is public property in a way that relies on its enforcement by the API. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-4278

GHSA-43CM-73PX-5V4M

Produtos afetados

Openstack Compute

Referências · 12

• https://github.com/openstack/nova · Nota
• https://github.com/openstack/nova/commit/6825959560e06725d26625fd21f5c0b78b305492 · Nota
• https://github.com/openstack/nova/commit/4054cc4a22a1fea997dec76afb5646fd6c6ea6b9 · Nota
• https://github.com/openstack/nova/commit/8b686195afe7e6dfb46c56c1ef2fe9c993d8e495 · Nota
• http://rhn.redhat.com/errata/RHSA-2013-1199.html · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2013-4278 · Aviso do Fabricante
• http://lists.openstack.org/pipermail/openstack-announce/2013-August/000138.html · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2013-4278 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2013-4278 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4278 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-43cm-73px-5v4m · Aviso do Fabricante
• https://bugs.launchpad.net/ossa/+bug/1212179 · Nota