PT-2013-4933 · Openstack · Openstack Compute

Kenichi Ohmichi + 1 · Published 2013-09-16 · Updated 2023-02-13 · CVE-2013-4278

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions Folsom through Havana

Description The issue is related to the "create an instance" API, which does not properly enforce the os-flavor-access:is public property. This allows remote authenticated users to boot arbitrary flavors by guessing the flavor id.

Recommendations For OpenStack Compute (Nova) versions Folsom through Havana, as a temporary workaround, consider restricting access to the "create an instance" API until a proper fix is applied. Avoid using the os-flavor-access:is public property in a way that relies on its enforcement by the API. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-4278

GHSA-43CM-73PX-5V4M

Affected Products

Openstack Compute

References · 12

• https://osv.dev/vulnerability/GHSA-43cm-73px-5v4m · Vendor Advisory
• http://lists.openstack.org/pipermail/openstack-announce/2013-August/000138.html · Patch
• http://rhn.redhat.com/errata/RHSA-2013-1199.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-4278 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4278 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4278 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-4278 · Vendor Advisory
• https://github.com/openstack/nova · Note
• https://github.com/openstack/nova/commit/8b686195afe7e6dfb46c56c1ef2fe9c993d8e495 · Note
• https://github.com/openstack/nova/commit/4054cc4a22a1fea997dec76afb5646fd6c6ea6b9 · Note
• https://github.com/openstack/nova/commit/6825959560e06725d26625fd21f5c0b78b305492 · Note
• https://bugs.launchpad.net/ossa/+bug/1212179 · Note