CVE-2013-6419

Publication date 11 December 2013

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron.

Read the notes from the security team

Status

No maintained releases are affected by this CVE.

Package Ubuntu Release Status
neutron 13.10 saucy
Not affected
13.04 raring Not in release
12.10 quantal Not in release
12.04 LTS precise Not in release
10.04 LTS lucid Not in release
nova 13.10 saucy
Not affected
13.04 raring Ignored
12.10 quantal Ignored
12.04 LTS precise Ignored
10.04 LTS lucid Not in release

Notes

mdeslaur

OSSA 2013-033

jdstrand

requires updating both nova and neutron. Ubuntu 13.04 and lower do not have neutron in the archive, so ignoring requires instance_id to be exposed to attacker

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
neutron
nova