CVE-2013-4261

Published: 22 August 2013

OpenStack Compute (Nova) Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to cause a denial of service (connection pool consumption), as demonstrated using multiple requests that send long strings to an instance console and retrieving the console log.

Notes

Ubuntu 13.04 has fix in raring-updates
backward-compatibility breaking change deemed too intrusive for
stable release update

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4261
• https://bugzilla.redhat.com/show_bug.cgi?id=999164
• https://bugs.launchpad.net/nova/+bug/1215091
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-4261
• https://bugs.launchpad.net/nova/+bug/1175808
• https://ubuntu.com/security/notices/USN-2000-1
• NVD
• Launchpad
• Debian