-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

OpenStack Security Advisory: 2013-026 CVE: CVE-2013-4261 Date: September 12, 2013 Title: Potential denial of service on Nova when using Qpid Reporter: Jaroslav Henner (Red Hat) Products: Nova Affects: Folsom, Grizzly

Description: Jaroslav Henner from Red Hat reported a vulnerability in Nova when using Apache Qpid as the RPC backend. By sending any random text longer than 65K characters to an instance console and requesting the console log contents through the API, an authenticated user may disrupt the nova-compute node his instance is running on. This vulnerability could be leveraged in a Denial of Service attack against the cloud provider. Only Folsom and Grizzly setups using Qpid as their RPC backend are affected. Havana setups, or setups using other RPC backends (like RabbitMQ), are all unaffected.

Grizzly fix: https://review.openstack.org/#/c/43303/

Folsom fix: https://review.openstack.org/#/c/45426/

References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4261 https://bugs.launchpad.net/nova/+bug/1215091

Regards,

- -- Thierry Carrez OpenStack Vulnerability Management Team