GitHub Advisoryadvisory · PyPI

GHSA-j6xh-q826-55jw OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack

MEDIUM Published 2022-05-17 Modified 2023-02-08 Official page ↗
Aliases
CVE-2013-4179
Ecosystem
PyPI
Packages
nova
Severity
Moderate
Weaknesses
CWE-119
Reviewed
2023-02-08

Affected packages

• PyPI nova: < 2013.2 → fixed in 2013.2

Description

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Related

Alias · CVE (1)

  • CVE-2013-4179 The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to… vulnerability

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References