TI-2013-03652 Aliases CVE-2013-4179 GHSA-j6xh-q826-55jw

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before…

LOW 25CWE-119Published 2013-09-16 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Partial
Fix status: Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-119 and the CVSS impact.

Summary

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Why it matters now

EPSS 0.02725 86th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial nova (PyPI): 2013.2Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	nova (PyPI)	before 2013.2	2013.2	Patch available	GHSA-j6xh-q826-55jw

— Vendor— Affected all versions Fixed in — No fix listed CNA
nova (PyPI) Vendor— Affected before 2013.2 Fixed in 2013.2 Patch available GHSA-j6xh-q826-55jw

CPE configurations NVD · 3

CPE	Versions	Role	Vendor
cpe:2.3:a:openstack:havana::::::::	up to havana-2	Vulnerable	OpenStack
cpe:2.3:a:openstack:havana:havana-1:::::::*	havana-1	Vulnerable	OpenStack
cpe:2.3:a:openstack:compute:2013.1.3:::::::*	2013.1.3	Vulnerable	OpenStack

cpe:2.3:a:openstack:havana:*:*:*:*:*:*:*:* Versions up to havana-2 Vulnerable ·OpenStack
cpe:2.3:a:openstack:havana:havana-1:*:*:*:*:*:*:* Versions havana-1 Vulnerable ·OpenStack
cpe:2.3:a:openstack:compute:2013.1.3:*:*:*:*:*:*:* Versions 2013.1.3 Vulnerable ·OpenStack

Remediation

Fix · GHSA-j6xh-q826-55jw nova (PyPI) Fixed in 2013.2 Advisory →

Red Hat 1 advisory

RHSA-2013:1199 Released 2013-09-03 · Red Hat rating Moderate
openstack-nova security and bug fix update
- Red Hat Enterprise Linux OpenStack Platform 3.0 openstack-nova-2013.1.3-3.el6ost, openstack-nova-api-2013.1.3-3.el6ost, openstack-nova-cells-2013.1.3-3.el6ost +10

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenStack Platform 4	Affected	No fix yet
Red Hat Enterprise Linux OpenStack Platform 3.0	Fixed	RHSA-2013:1199

Timeline

2026-10-02 Threatist record created from CVE-2013-4179
2026-10-03 Alias added: GHSA-j6xh-q826-55jw

References

Exploit 1

https://bugs.launchpad.net/ossa/+bug/1190229

Patch 1

RHSA-2013:1199

Advisory 2

Other 4

TI-2013-05849 The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver… CVSS 2.0HIGH 7.1
TI-2014-00161 The Nova EC2 API security group implementation in OpenStack Compute (Nova) 2013.1 before… CVSS 2.0MEDIUM 6.0
TI-2013-02015 Improper certificate validation in OpenStack Keystone CVSS 3.1MEDIUM 5.9
TI-2012-02292 The (1) EC2 and (2) OS APIs in OpenStack Compute (Nova) Folsom (2012.2), Essex (2012.1)… CVSS 2.0MEDIUM 4.3
TI-2013-03658 Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and… CVSS 2.0MEDIUM 4.0
TI-2015-02371 OpenStack Compute (nova) Icehouse, Juno and Havana when live migration fails allows local… CVSS 3.0MEDIUM 4.7

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences