CVE-2013-4185: OpenStack Nova Denial of Service in network source security groups

May 14, 2022 (updated May 14, 2024)

Algorithmic complexity vulnerability in OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-3 does not properly handle network source security group policy updates, which allows remote authenticated users to cause a denial of service (nova-network consumption) via a large number of server-creation operations, which triggers a large number of update requests.

References

bugs.launchpad.net/nova/+bug/1184041
github.com/advisories/GHSA-ph2h-hh49-vh27
github.com/openstack/nova
nvd.nist.gov/vuln/detail/CVE-2013-4185

Code Behaviors & Features

Detect and mitigate CVE-2013-4185 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →