CVE-2013-4261: Buffer Overflow
Jaroslav Henner (jhenner) reports:
When console-log is run often enough, it seems to be causing death of nova-compute.
Other sources
OpenStack Compute (Nova) Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to cause a denial of service (connection pool consumption), as demonstrated using multiple requests that send long strings to an instance console and retrieving the console log.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4261?
CVE-2013-4261 has a moderate severity level, as it can cause nova-compute processes to terminate unexpectedly.
How do I fix CVE-2013-4261?
To fix CVE-2013-4261, upgrade to a version of OpenStack that is not affected, particularly later versions than Folsom and Grizzly.
What versions are affected by CVE-2013-4261?
CVE-2013-4261 affects OpenStack Compute (Nova) versions Folsom, Grizzly, and earlier when using Apache Qpid.
What actions can be taken to mitigate CVE-2013-4261 risks?
To mitigate the risks of CVE-2013-4261, monitor nova-compute logs for errors and consider rate limiting console-log usage.
Is there a workaround for CVE-2013-4261?
A possible workaround for CVE-2013-4261 is to avoid using Apache Qpid for the RPC backend in affected OpenStack deployments.