VulnerabilityModified
CVE-2013-4497
The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions.
MEDIUM 6.4EPSS 1.82%
Does this matter?
Lower severity and a low EPSS score (1.82%). Track it; it rarely justifies an emergency change on its own.
Description
The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions.
- CVSS 2.0
- 6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N
- EPSS
- 1.82% probability · 78th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- openstack/havana · openstack/grizzly · openstack/folsom
- Source
- secalert@redhat.com
References
- http://www.openwall.com/lists/oss-security/2013/11/03/2
- http://www.openwall.com/lists/oss-security/2013/11/03/3
- https://bugs.launchpad.net/nova/+bug/1073306
- https://bugs.launchpad.net/nova/+bug/1202266
- http://www.openwall.com/lists/oss-security/2013/11/03/2
- http://www.openwall.com/lists/oss-security/2013/11/03/3
- https://bugs.launchpad.net/nova/+bug/1073306
- https://bugs.launchpad.net/nova/+bug/1202266
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.