TI-2013-05373 Aliases CVE-2013-6419 GHSA-22w9-j288-8p9w

Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1…

LOW 27CWE-200Published 2014-01-07 · Updated 2024-08-06

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Partial · None · None
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.

Summary

Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron.

Why it matters now

EPSS 0.01852 79th percentileScored 2026-11-07

Fix Fixed nova (PyPI): 12.0.0a0Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	nova (PyPI)	before 12.0.0a0	12.0.0a0	Patch available	GHSA-22w9-j288-8p9w

— Vendor— Affected all versions Fixed in — No fix listed CNA
nova (PyPI) Vendor— Affected before 12.0.0a0 Fixed in 12.0.0a0 Patch available GHSA-22w9-j288-8p9w

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:openstack:havana::::::::	up to havana-1	Vulnerable	OpenStack

cpe:2.3:a:openstack:havana:*:*:*:*:*:*:*:* Versions up to havana-1 Vulnerable ·OpenStack

Remediation

Fix · GHSA-22w9-j288-8p9w nova (PyPI) Fixed in 12.0.0a0 Advisory →

Red Hat 2 advisories

RHSA-2014:0231 Released 2014-03-04 · Red Hat rating Moderate
openstack-nova security and bug fix update
- Red Hat Enterprise Linux OpenStack Platform 4.0 openstack-nova-2013.2.2-2.el6ost, openstack-nova-api-2013.2.2-2.el6ost, openstack-nova-cells-2013.2.2-2.el6ost +11
RHSA-2014:0091 Released 2014-01-22 · Red Hat rating Moderate
openstack-neutron security, bug fix, and enhancement update
- Red Hat Enterprise Linux OpenStack Platform 4.0 openstack-neutron-2013.2.1-4.el6ost, openstack-neutron-bigswitch-2013.2.1-4.el6ost, openstack-neutron-brocade-2013.2.1-4.el6ost +15

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux OpenStack Platform 4.0	Fixed	RHSA-2014:0091, RHSA-2014:0231

Timeline

2026-10-02 Threatist record created from CVE-2013-6419
2026-10-03 Alias added: GHSA-22w9-j288-8p9w

References

Patch 1

[oss-security] 20131211 [OSSA 2013-033] Metadata queries from Neutron to Nova are not restricted by tenant (CVE-2013-6419)

Advisory 3

Other 7

TI-2013-01930 XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and… CVSS 2.0HIGH 7.5
TI-2013-05849 The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver… CVSS 2.0HIGH 7.1
TI-2013-03945 The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2… CVSS 2.0MEDIUM 6.4
TI-2013-03652 The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before… CVSS 2.0MEDIUM 4.3
TI-2013-03628 OpenStack Swift before 1.9.1 in Folsom, Grizzly, and Havana allows authenticated users to… CVSS 2.0MEDIUM 4.0
TI-2013-03926 The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a… CVSS 2.0LOW 3.3

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences