Vulnerability Description
The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openstack | Havana | <= havana-2 |
| Openstack | Compute | 2013.1.3 |
Related Weaknesses (CWE)
References
- http://rhn.redhat.com/errata/RHSA-2013-1199.htmlPatchVendor Advisory
- http://www.ubuntu.com/usn/USN-2005-1
- https://bugs.launchpad.net/ossa/+bug/1190229Exploit
- http://rhn.redhat.com/errata/RHSA-2013-1199.htmlPatchVendor Advisory
- http://www.ubuntu.com/usn/USN-2005-1
- https://bugs.launchpad.net/ossa/+bug/1190229Exploit
FAQ
What is CVE-2013-4179?
CVE-2013-4179 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via...
How severe is CVE-2013-4179?
CVE-2013-4179 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-4179?
Check the references section above for vendor advisories and patch information. Affected products include: Openstack Havana, Openstack Compute.