Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
3.5
CVE-2013-4261: OpenStack Nova (Folsom/Grizzly) can be crashed via Qpid messaging
CVE-2013-4261 · published 13 years ago
Summary
Versions of OpenStack Compute (Nova) from Folsom and Grizzly that use Apache Qpid for internal communication do not correctly handle certain messaging errors. An attacker can send specially crafted long strings to a virtual machine console, filling up the connection pool and causing the service to stop responding. Apply the latest OpenStack patches or switch to a supported RPC backend to stop the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| openstack | folsom |
<= - cpe:2.3:a:openstack:folsom:*:*:*:*:*:*:*:* |
| openstack | grizzly |
<= - cpe:2.3:a:openstack:grizzly:*:*:*:*:*:*:*:* |
| redhat | openstack |
3.0 cpe:2.3:a:redhat:openstack:3.0:*:*:*:*:*:*:* |
Original advisory text
OpenStack Compute (Nova) Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to caus...
OpenStack Compute (Nova) Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to cause a denial of service (connection pool consumption), as demonstrated using multiple requests that send long strings to an instance console and retrieving the console log.
References
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
3.5
Low
Type
CWE-119Buffer Overflow
Timeline
Published29 Oct 2013
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2013-4261 · NVD
Track software like this
Free during beta