CVE-2013-4469

描述

OpenStack Compute (Nova) Folsom, Grizzly, and Havana, when use_cow_images is set to False, does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by transferring an image with a large virtual size that does not contain a large amount of data from Glance. NOTE: this issue is due to an incomplete fix for CVE-2013-2096.

如何修補 CVE-2013-4469

要修補 CVE-2013-4469,請將受影響套件升級到下列已修補版本。

• PyPI/nova—升級至 12.0.0a0 或更新版本
• —升級至 12.0.0a0 或更新版本

CVE-2013-4469 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(2)

• from 0, < 12.0.0a0
• from 0, < 12.0.0a0

參考連結(10)

• ADVISORYgithub.com/advisories/GHSA-2w87-5qcj-j6gx
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2013-4469
• PATCHgithub.com/openstack/nova
• PATCHpypi.org/project/nova
• WEBwww.openwall.com/lists/oss-security/2013/10/31/3