OpenStack Cinder vulnerability

2013-02-2100:00:00

ubuntu.com

9.3 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:N/A:P

0.09 Low

EPSS

Percentile

94.5%

JSON

Releases

Ubuntu 12.10

Packages

cinder - Cinder storage service - api server

Details

Stuart Stent discovered that Cinder would allow XML entity processing. A
remote unauthenticated attacker could exploit this using the Cinder API to
cause a denial of service via resource exhaustion. (CVE-2013-1664)

OSVersionArchitecturePackageVersionFilename
Ubuntu12.10noarchpython-cinder< 2012.2.1-0ubuntu1.1UNKNOWN
Ubuntu12.10noarchcinder-api< 2012.2.1-0ubuntu1.1UNKNOWN
Ubuntu12.10noarchcinder-common< 2012.2.1-0ubuntu1.1UNKNOWN
Ubuntu12.10noarchcinder-scheduler< 2012.2.1-0ubuntu1.1UNKNOWN
Ubuntu12.10noarchcinder-volume< 2012.2.1-0ubuntu1.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	12.10	noarch	python-cinder	< 2012.2.1-0ubuntu1.1	UNKNOWN
Ubuntu	12.10	noarch	cinder-api	< 2012.2.1-0ubuntu1.1	UNKNOWN
Ubuntu	12.10	noarch	cinder-common	< 2012.2.1-0ubuntu1.1	UNKNOWN
Ubuntu	12.10	noarch	cinder-scheduler	< 2012.2.1-0ubuntu1.1	UNKNOWN
Ubuntu	12.10	noarch	cinder-volume	< 2012.2.1-0ubuntu1.1	UNKNOWN