{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2013-11-05T20:00:00Z"}, "references": [{"name": "[oss-security] 20131103 CVE request for a vulnerability in OpenStack Nova", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2013/11/03/2"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugs.launchpad.net/nova/+bug/1202266"}, {"name": "[oss-security] 20131103 Re: CVE request for a vulnerability in OpenStack Nova", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2013/11/03/3"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugs.launchpad.net/nova/+bug/1073306"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T16:45:14.926Z"}, "title": "CVE Program Container", "references": [{"name": "[oss-security] 20131103 CVE request for a vulnerability in OpenStack Nova", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2013/11/03/2"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugs.launchpad.net/nova/+bug/1202266"}, {"name": "[oss-security] 20131103 Re: CVE request for a vulnerability in OpenStack Nova", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2013/11/03/3"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugs.launchpad.net/nova/+bug/1073306"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2013-4497", "state": "PUBLISHED", "dateReserved": "2013-06-12T00:00:00Z", "datePublished": "2013-11-05T20:00:00Z", "dateUpdated": "2024-08-06T16:45:14.926Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openstack:havana:*:*:*:*:*:*:*:*", "matchCriteriaId": "6D92E64B-9490-4A19-8EE2-98B46E5C3A32", "versionEndIncluding": "havana-3", "vulnerable": true}, {"criteria": "cpe:2.3:a:openstack:havana:havana-1:*:*:*:*:*:*:*", "matchCriteriaId": "45762277-1BC6-4552-B5AB-756AE8D9F543", "vulnerable": true}, {"criteria": "cpe:2.3:a:openstack:havana:havana-2:*:*:*:*:*:*:*", "matchCriteriaId": "588B9906-F0A0-4109-94D9-11481135ED06", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openstack:grizzly:-:*:*:*:*:*:*:*", "matchCriteriaId": "A83ED744-9E3D-4510-B3E6-6DDE1090F0B7", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openstack:folsom:-:*:*:*:*:*:*:*", "matchCriteriaId": "F5BA13BC-F088-45AA-AD10-B74F89CE5375", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions."}, {"lang": "es", "value": "El backend XenAPI en OpenStack Compute (Nova) Folsom, Grizzly, y Habana anterior a 2013.2 no se aplica correctamente los grupos de seguridad (1) al cambiar el tama\u00f1o de una imagen o (2) durante la migraci\u00f3n en tiempo real, lo que permite a atacantes remotos evitar las restricciones previstas."}], "id": "CVE-2013-4497", "lastModified": "2013-11-07T01:11:53.067", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 6.4, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2013-11-05T20:55:29.633", "references": [{"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2013/11/03/2"}, {"source": "secalert@redhat.com", "url": "http://www.openwall.com/lists/oss-security/2013/11/03/3"}, {"source": "secalert@redhat.com", "url": "https://bugs.launchpad.net/nova/+bug/1073306"}, {"source": "secalert@redhat.com", "url": "https://bugs.launchpad.net/nova/+bug/1202266"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2014:0366", "cpe": "cpe:/a:redhat:openstack:3::el6", "package": "openstack-nova-0:2013.1.5-2.el6ost", "product_name": "OpenStack 3 for RHEL 6", "release_date": "2014-04-03T00:00:00Z"}], "bugzilla": {"description": "openstack-nova: XenAPI security groups not kept through migrate or resize", "id": "1026171", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1026171"}, "csaw": false, "cvss": {"cvss_base_score": "3.6", "cvss_scoring_vector": "AV:N/AC:H/Au:S/C:P/I:P/A:N", "status": "verified"}, "details": ["The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions."], "name": "CVE-2013-4497", "package_state": [{"cpe": "cpe:/a:redhat:openstack:4", "fix_state": "Affected", "package_name": "openstack-nova", "product_name": "Red Hat OpenStack Platform 4"}], "public_date": "2012-10-30T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2013-4497\nhttps://nvd.nist.gov/vuln/detail/CVE-2013-4497\nhttps://launchpad.net/bugs/1073306\nhttps://launchpad.net/bugs/1202266"], "threat_severity": "Low"}