CVE-2013-6426: Medium severity Openstack Heat vulnerability
The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intended access restrictions and (1) create a stack via the CreateStack method or (2) update a stack via the UpdateStack method.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenStack Orchestration API (Heat)to a version that resolves this vulnerability.Fixed in 2013.2.1 - Upgrade
Upgrade
OpenStack Orchestration API (Heat)to a version that resolves this vulnerability.Fixed in icehouse-2
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6426?
CVE-2013-6426 is categorized as a moderate severity vulnerability.
How do I fix CVE-2013-6426?
The fix for CVE-2013-6426 involves upgrading to OpenStack Orchestration API (Heat) version Havana 2013.2.1 or later.
What systems are affected by CVE-2013-6426?
CVE-2013-6426 affects OpenStack Orchestration API (Heat) versions prior to Havana 2013.2.1 and Icehouse before icehouse-2.
What is the impact of CVE-2013-6426?
The impact of CVE-2013-6426 allows local in-instance users to bypass access restrictions and potentially create unauthorized stacks.
Who can exploit CVE-2013-6426?
CVE-2013-6426 can be exploited by any local in-instance user with access to the OpenStack Orchestration API.