{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated openstack-nova packages that fix two security issues and three bugs\nare now available for Red Hat Enterprise Linux OpenStack Platform 3.0.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.", "title": "Topic" }, { "category": "general", "text": "The openstack-nova packages provide OpenStack Compute (nova), which\nprovides services for provisioning, managing, and using virtual\nmachine instances.\n\nIt was discovered that enabling \"qpid_protocol = ssl\" in the nova.conf file\ndid not result in nova using SSL to communicate to Qpid. If Qpid was not\nconfigured to enforce SSL this could lead to sensitive information being\nsent unencrypted over the communication channel. (CVE-2013-6491)\n\nA flaw was found in the way OpenStack Compute controlled the size of disk\nimages. An authenticated remote user could use malicious compressed qcow2\ndisk images to consume large amounts of disk space, potentially causing a\ndenial of service on the OpenStack Compute nodes. (CVE-2013-4463)\n\nRed Hat would like to thank the OpenStack project for reporting\nCVE-2013-4463. Upstream acknowledges Bernhard M. Wiedemann of SuSE as the\noriginal reporter of this issue.\n\nThis update also fixes the following bugs:\n\n* When using GroupAntiAffinityFilter, the scheduler was not filtering\ninstances in the group, which could cause an instance to not be scheduled\nat all if a group was specified on boot. With this fix, groups are taken\ninto account and the instance is scheduled as expected. (BZ#1014948)\n\n* If an exchange had not been created previously by a consumer, the\npublisher would crash because it could not find the specified exchange.\nThis resulted from Qpid's direct publisher using the wrong exchange type\n'Direct'. With this fix, the exchange type in the publisher has been\nchanged to 'direct'. (BZ#1042055)\n\n* Unhandled errors in the Qpid consuming thread could kill it silently and\nisolate the component from the rest of the system. To fix this, the\nconsuming thread has been made more resilient to errors by ensuring it does\nnot die on an unhandled error. Compute now logs the error and retries the\nconsuming thread. (BZ#1050213)\n\nAll openstack-nova users are advised to upgrade to these updated packages,\nwhich contain backported patches to correct these issues.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2014:0112", "url": "https://access.redhat.com/errata/RHSA-2014:0112" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "996766", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=996766" }, { "category": "external", "summary": "1014948", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1014948" }, { "category": "external", "summary": "1023239", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1023239" }, { "category": "external", "summary": "1044562", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1044562" }, { "category": "external", "summary": "1050213", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1050213" }, { "category": "external", "summary": "1059504", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1059504" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0112.json" } ], "title": "Red Hat Security Advisory: openstack-nova security and bug fix update", "tracking": { "current_release_date": "2026-06-27T11:35:07+00:00", "generator": { "date": "2026-06-27T11:35:07+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.2.6" } }, "id": "RHSA-2014:0112", "initial_release_date": "2014-01-30T19:58:47+00:00", "revision_history": [ { "date": "2014-01-30T19:58:47+00:00", "number": "1", "summary": "Initial version" }, { "date": "2014-01-30T19:58:47+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2026-06-27T11:35:07+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux OpenStack Platform 3.0", "product": { "name": "Red Hat Enterprise Linux OpenStack Platform 3.0", "product_id": "6Server-Grizzly", "product_identification_helper": { "cpe": "cpe:/a:redhat:openstack:3::el6" } } } ], "category": "product_family", "name": "Red Hat OpenStack Platform" }, { "branches": [ { "category": "product_version", "name": "openstack-nova-api-0:2013.1.4-4.el6ost.noarch", "product": { "name": "openstack-nova-api-0:2013.1.4-4.el6ost.noarch", "product_id": "openstack-nova-api-0:2013.1.4-4.el6ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-nova-api@2013.1.4-4.el6ost?arch=noarch" } } }, { "category": "product_version", "name": "openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch", "product": { "name": "openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch", "product_id": "openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-nova-conductor@2013.1.4-4.el6ost?arch=noarch" } } }, { "category": "product_version", "name": "openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch", "product": { "name": "openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch", "product_id": "openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-nova-scheduler@2013.1.4-4.el6ost?arch=noarch" } } }, { "category": "product_version", "name": "openstack-nova-0:2013.1.4-4.el6ost.noarch", "product": { "name": "openstack-nova-0:2013.1.4-4.el6ost.noarch", "product_id": "openstack-nova-0:2013.1.4-4.el6ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-nova@2013.1.4-4.el6ost?arch=noarch" } } }, { "category": "product_version", "name": "openstack-nova-cells-0:2013.1.4-4.el6ost.noarch", "product": { "name": "openstack-nova-cells-0:2013.1.4-4.el6ost.noarch", "product_id": "openstack-nova-cells-0:2013.1.4-4.el6ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-nova-cells@2013.1.4-4.el6ost?arch=noarch" } } }, { "category": "product_version", "name": "openstack-nova-cert-0:2013.1.4-4.el6ost.noarch", "product": { "name": "openstack-nova-cert-0:2013.1.4-4.el6ost.noarch", "product_id": "openstack-nova-cert-0:2013.1.4-4.el6ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-nova-cert@2013.1.4-4.el6ost?arch=noarch" } } }, { "category": "product_version", "name": "openstack-nova-console-0:2013.1.4-4.el6ost.noarch", "product": { "name": "openstack-nova-console-0:2013.1.4-4.el6ost.noarch", "product_id": "openstack-nova-console-0:2013.1.4-4.el6ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-nova-console@2013.1.4-4.el6ost?arch=noarch" } } }, { "category": "product_version", "name": "openstack-nova-doc-0:2013.1.4-4.el6ost.noarch", "product": { "name": "openstack-nova-doc-0:2013.1.4-4.el6ost.noarch", "product_id": "openstack-nova-doc-0:2013.1.4-4.el6ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-nova-doc@2013.1.4-4.el6ost?arch=noarch" } } }, { "category": "product_version", "name": "openstack-nova-network-0:2013.1.4-4.el6ost.noarch", "product": { "name": "openstack-nova-network-0:2013.1.4-4.el6ost.noarch", "product_id": "openstack-nova-network-0:2013.1.4-4.el6ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-nova-network@2013.1.4-4.el6ost?arch=noarch" } } }, { "category": "product_version", "name": "openstack-nova-compute-0:2013.1.4-4.el6ost.noarch", "product": { "name": "openstack-nova-compute-0:2013.1.4-4.el6ost.noarch", "product_id": "openstack-nova-compute-0:2013.1.4-4.el6ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-nova-compute@2013.1.4-4.el6ost?arch=noarch" } } }, { "category": "product_version", "name": "openstack-nova-common-0:2013.1.4-4.el6ost.noarch", "product": { "name": "openstack-nova-common-0:2013.1.4-4.el6ost.noarch", "product_id": "openstack-nova-common-0:2013.1.4-4.el6ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-nova-common@2013.1.4-4.el6ost?arch=noarch" } } }, { "category": "product_version", "name": "python-nova-0:2013.1.4-4.el6ost.noarch", "product": { "name": "python-nova-0:2013.1.4-4.el6ost.noarch", "product_id": "python-nova-0:2013.1.4-4.el6ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-nova@2013.1.4-4.el6ost?arch=noarch" } } }, { "category": "product_version", "name": "openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch", "product": { "name": "openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch", "product_id": "openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-nova-objectstore@2013.1.4-4.el6ost?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "openstack-nova-0:2013.1.4-4.el6ost.src", "product": { "name": "openstack-nova-0:2013.1.4-4.el6ost.src", "product_id": "openstack-nova-0:2013.1.4-4.el6ost.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-nova@2013.1.4-4.el6ost?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openstack-nova-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0", "product_id": "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.noarch" }, "product_reference": "openstack-nova-0:2013.1.4-4.el6ost.noarch", "relates_to_product_reference": "6Server-Grizzly" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-nova-0:2013.1.4-4.el6ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 3.0", "product_id": "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.src" }, "product_reference": "openstack-nova-0:2013.1.4-4.el6ost.src", "relates_to_product_reference": "6Server-Grizzly" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-nova-api-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0", "product_id": "6Server-Grizzly:openstack-nova-api-0:2013.1.4-4.el6ost.noarch" }, "product_reference": "openstack-nova-api-0:2013.1.4-4.el6ost.noarch", "relates_to_product_reference": "6Server-Grizzly" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-nova-cells-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0", "product_id": "6Server-Grizzly:openstack-nova-cells-0:2013.1.4-4.el6ost.noarch" }, "product_reference": "openstack-nova-cells-0:2013.1.4-4.el6ost.noarch", "relates_to_product_reference": "6Server-Grizzly" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-nova-cert-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0", "product_id": "6Server-Grizzly:openstack-nova-cert-0:2013.1.4-4.el6ost.noarch" }, "product_reference": "openstack-nova-cert-0:2013.1.4-4.el6ost.noarch", "relates_to_product_reference": "6Server-Grizzly" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-nova-common-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0", "product_id": "6Server-Grizzly:openstack-nova-common-0:2013.1.4-4.el6ost.noarch" }, "product_reference": "openstack-nova-common-0:2013.1.4-4.el6ost.noarch", "relates_to_product_reference": "6Server-Grizzly" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-nova-compute-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0", "product_id": "6Server-Grizzly:openstack-nova-compute-0:2013.1.4-4.el6ost.noarch" }, "product_reference": "openstack-nova-compute-0:2013.1.4-4.el6ost.noarch", "relates_to_product_reference": "6Server-Grizzly" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0", "product_id": "6Server-Grizzly:openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch" }, "product_reference": "openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch", "relates_to_product_reference": "6Server-Grizzly" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-nova-console-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0", "product_id": "6Server-Grizzly:openstack-nova-console-0:2013.1.4-4.el6ost.noarch" }, "product_reference": "openstack-nova-console-0:2013.1.4-4.el6ost.noarch", "relates_to_product_reference": "6Server-Grizzly" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-nova-doc-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0", "product_id": "6Server-Grizzly:openstack-nova-doc-0:2013.1.4-4.el6ost.noarch" }, "product_reference": "openstack-nova-doc-0:2013.1.4-4.el6ost.noarch", "relates_to_product_reference": "6Server-Grizzly" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-nova-network-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0", "product_id": "6Server-Grizzly:openstack-nova-network-0:2013.1.4-4.el6ost.noarch" }, "product_reference": "openstack-nova-network-0:2013.1.4-4.el6ost.noarch", "relates_to_product_reference": "6Server-Grizzly" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0", "product_id": "6Server-Grizzly:openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch" }, "product_reference": "openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch", "relates_to_product_reference": "6Server-Grizzly" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0", "product_id": "6Server-Grizzly:openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch" }, "product_reference": "openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch", "relates_to_product_reference": "6Server-Grizzly" }, { "category": "default_component_of", "full_product_name": { "name": "python-nova-0:2013.1.4-4.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0", "product_id": "6Server-Grizzly:python-nova-0:2013.1.4-4.el6ost.noarch" }, "product_reference": "python-nova-0:2013.1.4-4.el6ost.noarch", "relates_to_product_reference": "6Server-Grizzly" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Thierry Carrez" ], "organization": "OpenStack project" }, { "names": [ "Bernhard M. Wiedemann" ], "organization": "SuSE", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2013-4463", "discovery_date": "2013-10-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1023239" } ], "notes": [ { "category": "description", "text": "OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) via a compressed QCOW2 image. NOTE: this issue is due to an incomplete fix for CVE-2013-2096.", "title": "Vulnerability description" }, { "category": "summary", "text": "Nova: Compressed disk image DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "The Red Hat Security Response Team has rated this issue as having moderate security impact. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.src", "6Server-Grizzly:openstack-nova-api-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-cells-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-cert-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-common-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-compute-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-console-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-doc-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-network-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:python-nova-0:2013.1.4-4.el6ost.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-4463" }, { "category": "external", "summary": "RHBZ#1023239", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1023239" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4463", "url": "https://www.cve.org/CVERecord?id=CVE-2013-4463" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4463", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4463" } ], "release_date": "2013-10-31T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2014-01-30T19:58:47+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258", "product_ids": [ "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.src", "6Server-Grizzly:openstack-nova-api-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-cells-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-cert-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-common-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-compute-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-console-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-doc-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-network-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:python-nova-0:2013.1.4-4.el6ost.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2014:0112" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "version": "2.0" }, "products": [ "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.src", "6Server-Grizzly:openstack-nova-api-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-cells-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-cert-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-common-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-compute-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-console-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-doc-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-network-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:python-nova-0:2013.1.4-4.el6ost.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Nova: Compressed disk image DoS" }, { "cve": "CVE-2013-6491", "discovery_date": "2014-01-29T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1059504" } ], "notes": [ { "category": "description", "text": "The python-qpid client (common/rpc/impl_qpid.py) in OpenStack Oslo before 2013.2 does not enforce SSL connections when qpid_protocol is set to ssl, which allows remote attackers to obtain sensitive information by sniffing the network.", "title": "Vulnerability description" }, { "category": "summary", "text": "nova: qpid SSL configuration", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.src", "6Server-Grizzly:openstack-nova-api-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-cells-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-cert-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-common-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-compute-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-console-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-doc-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-network-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:python-nova-0:2013.1.4-4.el6ost.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-6491" }, { "category": "external", "summary": "RHBZ#1059504", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1059504" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-6491", "url": "https://www.cve.org/CVERecord?id=CVE-2013-6491" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6491", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6491" } ], "release_date": "2013-03-22T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2014-01-30T19:58:47+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258", "product_ids": [ "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.src", "6Server-Grizzly:openstack-nova-api-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-cells-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-cert-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-common-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-compute-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-console-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-doc-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-network-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:python-nova-0:2013.1.4-4.el6ost.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2014:0112" } ], "scores": [ { "cvss_v2": { "accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-0:2013.1.4-4.el6ost.src", "6Server-Grizzly:openstack-nova-api-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-cells-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-cert-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-common-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-compute-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-conductor-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-console-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-doc-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-network-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-objectstore-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:openstack-nova-scheduler-0:2013.1.4-4.el6ost.noarch", "6Server-Grizzly:python-nova-0:2013.1.4-4.el6ost.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nova: qpid SSL configuration" } ] }