CVE-2013-4497

2013-11-0500:00:00

ubuntu.com

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:P/A:N

EPSS

0.004

Percentile

72.7%

JSON

The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana
before 2013.2 does not properly apply security groups (1) when resizing an
image or (2) during live migration, which allows remote attackers to bypass
intended restrictions.

Bugs

Notes

Author	Note
mdeslaur	OSSA 2013-030
jdstrand	the proposed patches have tests cases even though upstream only patched grizzly without a test case Ubuntu 12.04 LTS (essex) is not affected