Thierry Carrez (thierry) reports: Title: Denial of Service using XML entities in Nova/Cinder extensions Reporter: Grant Murphy (Red Hat) Products: Nova, Cinder Affects: Grizzly Description: Grant Murphy from Red Hat reported that vulnerabilities in XML request parsers were not fully patched in OSSA 2013-004. By leveraging XML entity expansion in specific extensions, an unauthenticated attacker may still consume excessive resources on the Nova or Cinder API servers, resulting in a denial of service and potentially a crash. Only Nova setups making use of the security group extension in Grizzly are affected. Only Cinder setups making use of the backups or volume transfer API extension in Grizzly are affected. References: https://bugs.launchpad.net/cinder/+bug/1190229
Please note that this was originally assigned a single CVE. It has since been split into two CVE's (CVE-2013-4179 continues to be used for Nova and CVE-2013-4202 should be used for Cinder).
Created attachment 782219 [details] nova-grizzly-CVE-2013-4179.patch
Created attachment 782220 [details] nova-master-CVE-2013-4179.patch
*** Bug 976208 has been marked as a duplicate of this bug. ***
*** Bug 973520 has been marked as a duplicate of this bug. ***
Created openstack-nova tracking bugs for this issue: Affects: fedora-all [bug 995172] Affects: epel-6 [bug 995173]
Acknowledgements: This issue was discovered by Grant Murphy of the Red Hat Product Security Team.
This issue has been addressed in following products: OpenStack 3 for RHEL 6 Via RHSA-2013:1199 https://rhn.redhat.com/errata/RHSA-2013-1199.html