CVE-2013-4179: Buffer Overflow
The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4179?
CVE-2013-4179 is associated with a denial of service vulnerability with a moderate severity level.
How do I fix CVE-2013-4179?
To fix CVE-2013-4179, upgrade OpenStack Compute to version 2013.1.4 or later and ensure that all security updates for your OpenStack deployment are applied.
What causes the vulnerability CVE-2013-4179?
CVE-2013-4179 is caused by an incomplete fix for a previous vulnerability that allows remote attackers to exploit XML Entity Expansion attacks.
Which OpenStack versions are affected by CVE-2013-4179?
CVE-2013-4179 affects OpenStack Compute version 2013.1.3 and OpenStack Havana versions before havana-3.
Is there a known exploit for CVE-2013-4179?
There are no publicly known exploits for CVE-2013-4179, but the vulnerability presents a risk of service disruption.