CVE-2013-4202 OpenStack Cinder Denial of Service using XML entities
MediumCVSS 4.3
EPSS 2.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi cinder(PyPI) | < 7.0.0a0 | 7.0.0a0 |
| debian/cinder(Debian:12) | < 2013.1.2-4 | 2013.1.2-4 |
| debian/cinder(Debian:13) | < 2013.1.2-4 | 2013.1.2-4 |
| debian/cinder(Debian:14) | < 2013.1.2-4 | 2013.1.2-4 |
| OpenStack cinder | >= 2013.1, <= 2013.1.3 | No fix listed |
| Canonical Ubuntu Linux | = 13.04 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugs.launchpad.net third-party-advisory
- github.com product
- github.com patch
- github.com patch
- RHSA-2013:1198 patch third-party-advisory vendor-advisory
- USN-2005-1 third-party-advisory vendor-advisory
- pypi.org product
- github.com vendor-advisory
- Debian Security Tracker CVE-2013-4202 vendor-advisory
- bugs.debian.org issue-tracking