CVE-2013-4179 OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack
Remote attackers can cause denial of service in OpenStack Compute via XML Entity Expansion attacks, requiring upgrades to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-4179?
CVE-2013-4179 is a medium-severity vulnerability in n/a, published on 16 Sep 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.
Weakness: CWE-119
Which versions are affected by CVE-2013-4179?
3 open source packages ship an affected version, including nova. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
nova PyPI | All versions | 2013.2 |
nova PyPI | All versions | 2013.2 |
nova PyPI | All versions | 2013.2 |
Products include Openstack Compute, Openstack Havana.
How do I fix CVE-2013-4179?
Upgrade nova to 2013.2 or later.
Is CVE-2013-4179 being exploited?
There is no known exploitation of CVE-2013-4179 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2013-7130 OpenStack Nova Live migration can leak root disk into ephemeral storage
- CVE-2014-0167 OpenStack Compute (Nova) allows remote authenticated users to gain privileges via API requests
- CVE-2015-2687 OpenStack Compute (Nova) Improper Access Control
- CVE-2012-2654 OpenStack Compute (Nova) Improper Input Validation
- CVE-2013-4185 OpenStack Nova Denial of Service in network source security groups
Sources
Also known as DEBIAN-CVE-2013-4179, GHSA-j6xh-q826-55jw, PYSEC-2026-875.