PT-2013-4892 · Openstack · Openstack Compute

Vishvananda + 1 · Published 2013-10-29 · Updated 2022-05-14 · CVE-2013-4185

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions before 2013.1.3 OpenStack Compute (Nova) Havana versions before havana-3

Description The issue does not properly handle network source security group policy updates, allowing remote authenticated users to cause a denial of service via a large number of server-creation operations. This triggers a large number of update requests, consuming nova-network resources.

Recommendations For OpenStack Compute (Nova) versions before 2013.1.3, update to version 2013.1.3 or later to resolve the issue. For OpenStack Compute (Nova) Havana versions before havana-3, update to havana-3 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2013-4185

GHSA-PH2H-HH49-VH27

RHSA-2013:1199

Affected Products

Openstack Compute

References · 12

• 🔥 https://bugs.launchpad.net/nova/+bug/1184041 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-4185 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-1199.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-4185 · Vendor Advisory
• http://seclists.org/oss-sec/2013/q3/282 · Patch
• https://security-tracker.debian.org/tracker/CVE-2013-4185 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ph2h-hh49-vh27 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4185 · Vendor Advisory
• https://github.com/openstack/nova · Note
• http://github.com/openstack/nova/commit/52ad911963da4095b213952dee3a430fe0c4c30f · Note
• http://github.com/openstack/nova/commit/d4ee081c5c0a5132781235177c430ebcf72b0b0b · Note
• http://github.com/openstack/nova/commit/85aac04704350566d6b06aa7a3b99649946c672c · Note