Lucene search
Ubuntu.comUB:CVE-2013-4278HistorySep 16, 2013 - 12:00 a.m.
CVE-2013-4278
2013-09-1600:00:00
ubuntu.com
ubuntu.com
8
3.5 Low
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:S/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
46.9%
The “create an instance” API in OpenStack Compute (Nova) Folsom, Grizzly,
and Havana does not properly enforce the os-flavor-access:is_public
property, which allows remote authenticated users to boot arbitrary flavors
by guessing the flavor id. NOTE: this issue is due to an incomplete fix for
CVE-2013-2256.
Bugs
- <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=720602>
- <https://bugs.launchpad.net/ossa/+bug/1212179>
Notes
| Author | Note |
|---|---|
| seth-arnold | An incomplete fix for CVE-2013-2256 caused this vulnerability |
| jdstrand | The version of nova in Ubuntu 13.04 in raring-updates needs this fix flavor_access.py API extension not available on Essex (Ubuntu 12.04 LTS) Ubuntu 12.10 still vulnerable to CVE-2013-2256 so it is not affected by this CVE |
Related
ubuntucve
ubuntucve
CVE-2013-2256
2013-08-06 00:00:00
debiancve
debiancve
CVE-2013-4278
2013-09-16 19:14:00
CVE-2013-2256
2013-09-16 19:14:00
prion
prion
Design/Logic Flaw
2013-09-16 19:14:00
Design/Logic Flaw
2013-09-16 19:14:00
github
github
cve
cve
CVE-2013-4278
2013-09-16 19:14:00
CVE-2013-2256
2013-09-16 19:14:00
securityvulns
securityvulns
[USN-2000-1] Nova vulnerabilities
2013-10-28 00:00:00
OpenStack multiple security vulnerabilities
2013-12-23 00:00:00
openvas
openvas
Ubuntu Update for nova USN-2000-1
2013-10-29 00:00:00
Ubuntu: Security Advisory (USN-2000-1)
2013-10-29 00:00:00
Fedora Update for openstack-nova FEDORA-2013-15373
2013-09-06 00:00:00
nessus
nessus
Ubuntu 12.04 LTS / 12.10 / 13.04 : nova vulnerabilities (USN-2000-1)
2013-10-24 00:00:00
Fedora 19 : openstack-nova-2013.1.3-2.fc19 (2013-15373)
2013-09-05 00:00:00
ubuntu
ubuntu
Nova vulnerabilities
2013-10-23 00:00:00
seebug
seebug
OpenStack Nova安全绕过漏洞
2013-08-11 00:00:00
veracode
veracode
Information Disclosure
2019-01-15 08:58:21
Denial Of Service (DoS)
2019-05-02 04:48:40
Denial Of Service (DoS)
2019-05-02 04:48:39
osv
osv
fedora
fedora
[SECURITY] Fedora 19 Update: openstack-nova-2013.1.3-2.fc19
2013-09-05 01:37:33
[SECURITY] Fedora 19 Update: openstack-nova-2013.1.4-6.fc19
2014-02-05 03:35:20
[SECURITY] Fedora 19 Update: openstack-nova-2013.1.4-3.fc19
2013-12-12 02:57:25
redhat
redhat
(RHSA-2013:1199) Moderate: openstack-nova security and bug fix update
2013-09-03 00:00:00
3.5 Low
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:S/C:P/I:N/A:N
0.001 Low
EPSS
Percentile
46.9%
Related for UB:CVE-2013-4278