GHSA-mfg4-9xf4-f45qMedium

OpenStack Cinder Denial of Service using XML entities

Published
May 14, 2022
Last Modified
May 14, 2024

🔗 CVE IDs covered (1)

CVE-2013-4202 →

📋 Description

The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

🎯 Affected products1

  • pip/cinder:< 7.0.0a0

🔗 References (7)