CVE-2013-4497: Medium severity openstack vulnerability
The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4497?
CVE-2013-4497 is classified as a moderate severity vulnerability due to the potential for security group bypass during image resizing and live migration.
How do I fix CVE-2013-4497?
To fix CVE-2013-4497, you should upgrade your OpenStack Nova installation to version 12.0.0a0 or later.
What versions of OpenStack are affected by CVE-2013-4497?
CVE-2013-4497 affects OpenStack Compute (Nova) versions Folsom, Grizzly, and Havana before 2013.2.
What impact does CVE-2013-4497 have on OpenStack deployments?
The impact of CVE-2013-4497 allows remote attackers to bypass intended restrictions on security groups during certain operations.
Is there a workaround for CVE-2013-4497 until I can apply the fix?
There is no documented workaround for CVE-2013-4497; the best mitigation is to apply the patch as soon as possible.