Thierry Carrez (thierry) reports:
Title: Denial of Service using XML entities in Nova/Cinder extensions
Reporter: Grant Murphy (Red Hat)
Products: Nova, Cinder
Affects: Grizzly and later
Description:
Grant Murphy from Red Hat reported that vulnerabilities in XML request
parsers were not fully patched in OSSA 2013-004. By leveraging XML
entity expansion in specific extensions, an unauthenticated attacker may
still consume excessive resources on the Nova or Cinder API servers,
resulting in a denial of service and potentially a crash. Only Nova
setups making use of the security group extension in Grizzly are
affected. Only Cinder setups making use of the backups or volume
transfer API extension in Grizzly are affected.
Proposed patches:
See attached patches. Unless a flaw is discovered in them, these patches
will be merged to Nova & Cinder master (havana) and stable/grizzly
branches on the public disclosure date.
Please note that this was originally assigned a single CVE. It has since
been split into two CVE's (CVE-2013-4179 continues to be used for Nova and
CVE-2013-4202 should be used for Cinder).