CVE-2013-4278: OpenStack Compute (Nova) Resource limit… – CVSS 3.5 · Watchpost

← All vulnerabilities

OpenStack Compute (Nova) Resource limit circumvention in Nova private flavors

낮음 3.5CVE-2013-4278 · GHSA-43cm-73px-5v4m · PYSEC-2026-862 · Published 16/09/2013 · updated 16/06/2026

요약

CVE-2013-4278은(는) nova에 영향을 주는 낮음 (CVSS 3.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.5%, 전체 취약점의 74.4%보다 높음.
조치: 12.0.0a0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
nova PyPI	`< 12.0.0a0`	`12.0.0a0`

Description

The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id. NOTE: this issue is due to an incomplete fix for CVE-2013-2256.

NVD description

The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id. NOTE: this issue is due to an incomplete fix for CVE-2013-2256.

References

nvd.nist.gov/vuln/detail/CVE-2013-4278 · ADVISORY
openstack/nova commit 4054cc4 · WEB
openstack/nova commit 6825959 · WEB
openstack/nova commit 8b68619 · WEB
bugs.launchpad.net/ossa/+bug/1212179 · WEB
openstack/nova · PACKAGE
lists.openstack.org/pipermail/openstack-announce/2013-August/000138.html · WEB
rhn.redhat.com/errata/RHSA-2013-1199.html · WEB
pypi.org/project/nova · PACKAGE
GitHub Advisory GHSA-43cm-73px-5v4m · ADVISORY

nova의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free