CVE-2013-4180 Denial of service in n/a

What is CVE-2013-4180?

CVE-2013-4180 is a medium-severity denial of service vulnerability in Redhat Openstack, published on 16 Sep 2013. It can be exploited over the network, with no action from the victim.

Official description

The (1) power and (2) ipmi_boot actions in the HostController in Foreman before 1.2.2 allow remote attackers to cause a denial of service (memory consumption) via unspecified input that is converted to a symbol.

Weakness: CWE-20

Which versions are affected by CVE-2013-4180?

It affects 2 products.

Products include Redhat Openstack, Theforeman Foreman.

How do I fix CVE-2013-4180?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2013-4180 being exploited?

There is no known exploitation of CVE-2013-4180 in the wild and no public exploit code.

Other vulnerabilities in Redhat Openstack

• CVE-2015-1842 Hardcoded credentials in n/a Critical 10.0
• CVE-2017-2637 Auth bypass in rhosp-director Critical 9.9
• CVE-2022-38065 Privilege escalation in OpenStack High 8.8
• CVE-2016-4474 Hardcoded credentials in n/a High 8.8
• CVE-2021-31918 Information disclosure in tripleo-ansible High 7.5

All Redhat Openstack vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xjcv-72f4-4fxj.