CVE-2013-4278
Published: 16 September 2013
The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id. NOTE: this issue is due to an incomplete fix for CVE-2013-2256.
Notes
Author | Note |
---|---|
seth-arnold | An incomplete fix for CVE-2013-2256 caused this vulnerability |
jdstrand | The version of nova in Ubuntu 13.04 in raring-updates needs this fix flavor_access.py API extension not available on Essex (Ubuntu 12.04 LTS) Ubuntu 12.10 still vulnerable to CVE-2013-2256 so it is not affected by this CVE |
Priority
Status
Package | Release | Status |
---|---|---|
nova Launchpad, Ubuntu, Debian |
upstream |
Needed
|
lucid |
Does not exist
|
|
precise |
Not vulnerable
(code-not-present)
|
|
quantal |
Not vulnerable
|
|
raring |
Released
(1:2013.1.3-0ubuntu1.1)
|
|
saucy |
Not vulnerable
(1:2013.2~rc2-0ubuntu1)
|
|
Patches: upstream: https://github.com/openstack/nova/commit/4054cc4a22a1fea997dec76afb5646fd6c6ea6b9 (havana) upstream: http://github.com/openstack/nova/commit/8b686195afe7e6dfb46c56c1ef2fe9c993d8e495 (grizzly) upstream: http://github.com/openstack/nova/commit/6825959560e06725d26625fd21f5c0b78b305492 (folsom) |