CVE-2013-4497

Publication date 5 November 2013

Last updated 24 July 2024

Ubuntu priority

The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2 does not properly apply security groups (1) when resizing an image or (2) during live migration, which allows remote attackers to bypass intended restrictions.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
nova	14.04 LTS trusty	Not in release
	13.10 saucy	Not affected
	13.04 raring	Ignored
	12.10 quantal	Ignored
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Not in release

Notes

mdeslaur

OSSA 2013-030

jdstrand

the proposed patches have tests cases even though upstream only patched grizzly without a test case Ubuntu 12.04 LTS (essex) is not affected

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
nova	Upstream: https://review.openstack.org/52991 Other: https://review.openstack.org/#/c/52989/ Other: https://review.openstack.org/#/c/52987/ Upstream: 01de658 Upstream: df2ea2e