Unscored severity · published Oct 29, 2013
CVE-2013-4261
OpenStack Compute (Nova) Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote…
–
CVSS
1.7%
EPSS
No
On KEV
Description
OpenStack Compute (Nova) Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to cause a denial of service (connection pool consumption), as demonstrated using multiple requests that send long strings to an instance console and retrieving the console log.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Folsom · Openstack
through - · source: NVD
GR
Grizzly · Openstack
through - · source: NVD
OP
Openstack · Redhat
3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-4261
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-4261
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2013-1199.html
Patch
http://seclists.org/oss-sec/2013/q3/595
Exploit
https://bugs.launchpad.net/nova/+bug/1215091
Exploit
https://bugzilla.redhat.com/show_bug.cgi?id=999164
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=999271
More from Folsom
8.8
CVE-2013-0261
A flaw was found in PackStack
7.6
CVE-2013-0335
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) allows remote authenticated users to gain access to a VM in opportunistic circumstances by using the VNC…
5.5
CVE-2013-0266
A flaw was found in the `puppetlabs-cinder` module, as used in PackStack
5.4
CVE-2012-5571
A flaw was found in OpenStack Keystone
–
CVE-2013-4463
OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file…