PT-2013-3422 · Openstack · Openstack Compute

Published 2013-03-22 · Updated 2022-05-17 · CVE-2013-1838

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions Grizzly, Folsom (2012.2), Essex (2012.1)

Description The issue allows remote authenticated users to cause a denial of service, resulting in resource exhaustion and failure to spawn new instances, by making a large number of calls to the addFixedIp function. This is due to the improper implementation of a quota for fixed IPs.

Recommendations For OpenStack Compute (Nova) versions Grizzly, Folsom (2012.2), Essex (2012.1), consider restricting access to the addFixedIp function to prevent excessive calls and mitigate the risk of resource exhaustion.

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

CWE-399

Related Identifiers

CVE-2013-1838

GHSA-63FQ-8FP9-VHWQ

PYSEC-2013-44

RHSA-2013:0709

Affected Products

Openstack Compute

References · 25

• https://osv.dev/vulnerability/GHSA-63fq-8fp9-vhwq · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0709.html · Vendor Advisory
• http://secunia.com/advisories/52580 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-1838 · Vendor Advisory
• http://secunia.com/advisories/52728 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1838 · Security Note
• http://ubuntu.com/usn/usn-1771-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-1838 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2013-44 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1838 · Vendor Advisory
• https://github.com/openstack/nova · Note
• https://github.com/openstack/nova/commit/9561484166f245d0e4602a36351d6cac72dd9426 · Note
• https://github.com/openstack/nova/commit/efaacdaee116388234558e2682b647d41fe5b149 · Note
• https://github.com/openstack/nova/commit/99429214d4ddb5bdc7de185693b8a53ad50df3c6 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2013-44.yaml · Note