Vulnerability Description
The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openstack | Cinder | >= 2013.1, <= 2013.1.3 |
| Canonical | Ubuntu Linux | 13.04 |
Related Weaknesses (CWE)
References
- http://rhn.redhat.com/errata/RHSA-2013-1198.htmlPatchThird Party Advisory
- http://www.ubuntu.com/usn/USN-2005-1Third Party Advisory
- https://bugs.launchpad.net/ossa/+bug/1190229Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2013-1198.htmlPatchThird Party Advisory
- http://www.ubuntu.com/usn/USN-2005-1Third Party Advisory
- https://bugs.launchpad.net/ossa/+bug/1190229Third Party Advisory
FAQ
What is CVE-2013-4202?
CVE-2013-4202 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service ...
How severe is CVE-2013-4202?
CVE-2013-4202 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2013-4202?
Check the references section above for vendor advisories and patch information. Affected products include: Openstack Cinder, Canonical Ubuntu Linux.