En bref
- CVE-2013-4179 est une vulnérabilité MOYENNE (CVSS 4.3) touchant nova, compute (openstack), havana (openstack).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.7%, plus élevée que 86.1% des vulnérabilités.
- Correctif : mettre à jour vers 2013.2 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| nova PyPI | < 2013.2
| 2013.2
|
| compute | = 2013.1.3
| No fix yet |
| havana | = havana-1≤ havana-2
| No fix yet |
Description
The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.
NVD description
The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free