OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) does not properly…
Priority LOW 24CWE-399Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-399 and the CVSS impact.
Summary
OpenStack Compute (Nova) Grizzly, Folsom (2012.2), and Essex (2012.1) does not properly implement a quota for fixed IPs, which allows remote authenticated users to cause a denial of service (resource exhaustion and failure to spawn new instances) via a large number of calls to the addFixedIp function.
Why it matters now
EPSS 0.02742 86th percentileScored 2026-11-07
Fix Fixed nova (PyPI): 12.0.0a0Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | nova (PyPI) | before 12.0.0a0 | 12.0.0a0 | Patch available | GHSA-63fq-8fp9-vhwq |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- nova (PyPI) Vendor— Affected before 12.0.0a0 Fixed in 12.0.0a0 Patch available GHSA-63fq-8fp9-vhwq
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openstack:essex:2012.1:*:*:*:*:*:*:* | 2012.1 | Vulnerable | OpenStack |
| cpe:2.3:a:openstack:folsom:2012.2:*:*:*:*:*:*:* | 2012.2 | Vulnerable | OpenStack |
| cpe:2.3:a:openstack:grizzly:2012.2:*:*:*:*:*:*:* | 2012.2 | Vulnerable | OpenStack |
| cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:* | 11.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:* | 12.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* | 12.10 | Vulnerable | Canonical |
- cpe:2.3:a:openstack:essex:2012.1:*:*:*:*:*:*:* Versions 2012.1 Vulnerable ·OpenStack
- cpe:2.3:a:openstack:folsom:2012.2:*:*:*:*:*:*:* Versions 2012.2 Vulnerable ·OpenStack
- cpe:2.3:a:openstack:grizzly:2012.2:*:*:*:*:*:*:* Versions 2012.2 Vulnerable ·OpenStack
- cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:* Versions 11.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:* Versions 12.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:* Versions 12.10 Vulnerable ·Canonical
Remediation
- Fix · GHSA-63fq-8fp9-vhwq nova (PyPI) Fixed in 12.0.0a0 Advisory →
Red Hat 1 advisory
- RHSA-2013:0709 Released 2013-04-04 · Red Hat rating Moderateopenstack-nova security and bug fix update
- OpenStack Folsom openstack-nova-2012.2.3-7.el6ost, openstack-nova-api-2012.2.3-7.el6ost, openstack-nova-cert-2012.2.3-7.el6ost +9
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenStack Folsom | Fixed | RHSA-2013:0709 |
Timeline
- 2026-10-02 Threatist record created from CVE-2013-1838
- 2026-10-03 Alias added: GHSA-63fq-8fp9-vhwq
References
Other 16
- [openstack] 20130314 [OSSA 2013-008] Nova DoS by allocating all Fixed IPs (CVE-2013-1838)
- https://bugs.launchpad.net/nova/+bug/1125468
- https://review.openstack.org/#/c/24453/
- https://bugzilla.redhat.com/show_bug.cgi?id=919648
- 91303
- https://review.openstack.org/#/c/24452/
- https://review.openstack.org/#/c/24451/
- [oss-security] 20130314 [OSSA 2013-008] Nova DoS by allocating all Fixed IPs (CVE-2013-1838)
- https://github.com/openstack/nova/commit/9561484166f245d0e4602a36351d6cac72dd9426
- https://github.com/openstack/nova/commit/99429214d4ddb5bdc7de185693b8a53ad50df3c6
- https://github.com/openstack/nova/commit/efaacdaee116388234558e2682b647d41fe5b149
- https://github.com/openstack/nova
- https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2013-44.yaml
- https://review.openstack.org/#/c/24451
- https://review.openstack.org/#/c/24452
- https://review.openstack.org/#/c/24453
Sources
- CVE-2013-1838 · CVE Program
- CVE-2013-1838 · NVD
- FIRST EPSS
- GHSA-63fq-8fp9-vhwq · GitHub Advisory Database · CC BY 4.0
- CVE-2013-1838 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences