CVE-2013-6419
Fixed in a distro release EPSS 2%
Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron.
Products: openstack havana
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | nova | 12.0.0a0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | neutron | 2013.2.1-1 |
| Debian 12 | nova | 2013.2.1-1 |
| Debian 13 | neutron | 2013.2.1-1 |
| Debian 13 | nova | 2013.2.1-1 |
| Debian 14 | neutron | 2013.2.1-1 |
| Debian 14 | nova | 2013.2.1-1 |
| Red Hat openstack 4 | openstack-neutron | 0:2013.2.1-4.el6ost |
| Red Hat openstack 4 | openstack-neutron-bigswitch | 0:2013.2.1-4.el6ost |
| Red Hat openstack 4 | openstack-neutron-brocade | 0:2013.2.1-4.el6ost |
| Red Hat openstack 4 | openstack-neutron-cisco | 0:2013.2.1-4.el6ost |
| Red Hat openstack 4 | openstack-neutron-hyperv | 0:2013.2.1-4.el6ost |
| Red Hat openstack 4 | openstack-neutron-linuxbridge | 0:2013.2.1-4.el6ost |
| Red Hat openstack 4 | openstack-neutron-mellanox | 0:2013.2.1-4.el6ost |
| Red Hat openstack 4 | openstack-neutron-metaplugin | 0:2013.2.1-4.el6ost |
| Red Hat openstack 4 | openstack-neutron-metering-agent | 0:2013.2.1-4.el6ost |
| Red Hat openstack 4 | openstack-neutron-midonet | 0:2013.2.1-4.el6ost |
| Red Hat openstack 4 | openstack-neutron-ml2 | 0:2013.2.1-4.el6ost |
| Red Hat openstack 4 | openstack-neutron-nec | 0:2013.2.1-4.el6ost |
| Red Hat openstack 4 | openstack-neutron-nicira | 0:2013.2.1-4.el6ost |
| Red Hat openstack 4 | openstack-neutron-openvswitch | 0:2013.2.1-4.el6ost |
| Red Hat openstack 4 | openstack-neutron-plumgrid | 0:2013.2.1-4.el6ost |
| Red Hat openstack 4 | openstack-neutron-ryu | 0:2013.2.1-4.el6ost |
| Red Hat openstack 4 | openstack-neutron-vpn-agent | 0:2013.2.1-4.el6ost |
| Red Hat openstack 4 | openstack-nova | 0:2013.2.2-2.el6ost |
| Red Hat openstack 4 | openstack-nova-api | 0:2013.2.2-2.el6ost |
| Red Hat openstack 4 | openstack-nova-cells | 0:2013.2.2-2.el6ost |
| Red Hat openstack 4 | openstack-nova-cert | 0:2013.2.2-2.el6ost |
| Red Hat openstack 4 | openstack-nova-common | 0:2013.2.2-2.el6ost |
| Red Hat openstack 4 | openstack-nova-compute | 0:2013.2.2-2.el6ost |
| Red Hat openstack 4 | openstack-nova-conductor | 0:2013.2.2-2.el6ost |
| Red Hat openstack 4 | openstack-nova-console | 0:2013.2.2-2.el6ost |
| Red Hat openstack 4 | openstack-nova-doc | 0:2013.2.2-2.el6ost |
| Red Hat openstack 4 | openstack-nova-network | 0:2013.2.2-2.el6ost |
| Red Hat openstack 4 | openstack-nova-novncproxy | 0:2013.2.2-2.el6ost |
| Red Hat openstack 4 | openstack-nova-objectstore | 0:2013.2.2-2.el6ost |
| Red Hat openstack 4 | openstack-nova-scheduler | 0:2013.2.2-2.el6ost |
| Red Hat openstack 4 | python-neutron | 0:2013.2.1-4.el6ost |
| Red Hat openstack 4 | python-nova | 0:2013.2.2-2.el6ost |