CVE-2013-6419

Publication date 11 December 2013

Last updated 24 July 2024

Ubuntu priority

Description

Interaction error in OpenStack Nova and Neutron before Havana 2013.2.1 and icehouse-1 does not validate the instance ID of the tenant making a request, which allows remote tenants to obtain sensitive metadata by spoofing the device ID that is bound to a port, which is not properly handled by (1) api/metadata/handler.py in Nova and (2) the neutron-metadata-agent (agent/metadata/agent.py) in Neutron.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
neutron	13.10 saucy	Not affected
	13.04 raring	Not in release
	12.10 quantal	Not in release
	12.04 LTS precise	Not in release
	10.04 LTS lucid	Not in release
nova	13.10 saucy	Not affected
	13.04 raring	Ignored
	12.10 quantal	Ignored
	12.04 LTS precise	Ignored
	10.04 LTS lucid	Not in release

Notes

mdeslaur

OSSA 2013-033

jdstrand

requires updating both nova and neutron. Ubuntu 13.04 and lower do not have neutron in the archive, so ignoring requires instance_id to be exposed to attacker

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
neutron	Upstream: https://review.openstack.org/61442 Upstream: https://review.openstack.org/61439
nova	Upstream: https://review.openstack.org/61435 Upstream: https://review.openstack.org/61428