CVE-2013-4202

OpenStack Cinder (Grizzly, 2013.1.3 and earlier) backs up (api/contrib/backups.py) and volume_transfer (contrib/volume_transfer.py) APIs are vulnerable to XML Entity Expansion (XEE) leading to remote DoS (resource consumption and crash). Root cause is an incomplete fix for CVE-2013-1664 in the XM...

CVE-2013-4183

CVE-2013-4183 concerns OpenStack Cinder (LVMVolumeDriver) where the clear_volume routine used when deleting a snapshot does not properly clear data, potentially allowing local users to access sensitive information. The vulnerability affects OpenStack Cinder releases 2013.1.1 through 2013.1.2. Con...