CVE-2013-4261 OpenStack Compute (Nova) Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to cause a...
LowCVSS 3.5
EPSS 1.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Compute (Nova) Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to cause a denial of service (connection pool consumption), as demonstrated using multiple requests that send long strings to an instance console and retrieving the console log.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/nova(Debian:12) | < 2013.2-1 | 2013.2-1 |
| debian/nova(Debian:13) | < 2013.2-1 | 2013.2-1 |
| debian/nova(Debian:14) | < 2013.2-1 | 2013.2-1 |
| OpenStack folsom | <= - | No fix listed |
| OpenStack grizzly | <= - | No fix listed |
| redhat openstack | = 3.0 | No fix listed |
References
- Debian Security Tracker CVE-2013-4261 vendor-advisory
- RHSA-2013:1199 vendor-advisory
- [oss-security] 20130912 [OSSA 2013-026] Potential denial of service on Nova when using Qpid (CVE-2013-4261) mailing-list patch
- bugs.launchpad.net exploit
- bugzilla.redhat.com exploit patch
- bugzilla.redhat.com