{"id":"CVE-2013-4179","published":"2013-09-16T19:00:00Z","modified":"2024-08-06T16:38:00Z","title":"The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows…","vendor":null,"product":null,"tier":"tail","description":{"text":"The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.  NOTE: this issue is due to an incomplete fix for CVE-2013-1664.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02725,"percentile":0.86004,"provenance":"source"},"cwes":[],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-1199.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://bugs.launchpad.net/ossa/+bug/1190229","tags":["x_refsource_CONFIRM"]},{"url":"http://www.ubuntu.com/usn/USN-2005-1","tags":["vendor-advisory","x_refsource_UBUNTU"]}],"priority":{"score":17.2,"factors":[{"name":"EPSS percentile","points":17.2}]},"affected":[{"ecosystem":"PyPI","package":"nova","vulnerableRanges":["<2013.2"],"patched":["2013.2"],"from":["GHSA-j6xh-q826-55jw","PYSEC-2026-875"],"provenance":"source"}],"euvd":{"id":"EUVD-2022-4295","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-django-cve-2013-1664","parents":[{"from":"CVE-2013-1664","to":"CVE-2013-4179","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue is due to an incomplete fix for CVE-2013-1664.","from":"CVE.org","in":"CVE-2013-4179"}]}],"packageHistory":[{"cve":"CVE-2026-46448","published":"2026-06-16","fixed":"33.0.2","kev":false},{"cve":"CVE-2015-3241","published":"2015-09-08","fixed":"112.0.0.0b3","kev":false},{"cve":"CVE-2013-2256","published":"2013-09-16","fixed":"2013.1.3","kev":false,"link":{"from":"CVE-2013-2256","to":"CVE-2013-4179","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:nova","fromFixed":"2013.1.3","toFixed":"2013.2","daysApart":0}]}},{"cve":"CVE-2013-4179","published":"2013-09-16","fixed":"2013.2","kev":false},{"cve":"CVE-2014-0167","published":"2014-04-15","fixed":"2013.2.4","kev":false,"link":{"from":"CVE-2013-4179","to":"CVE-2014-0167","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:nova","fromFixed":"2013.2","toFixed":"2013.2.4","daysApart":211}]}},{"cve":"CVE-2014-3517","published":"2014-08-07","fixed":"2014.1.2","kev":false,"link":{"from":"CVE-2013-4179","to":"CVE-2014-3517","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:nova","fromFixed":"2013.2","toFixed":"2013.2.4","daysApart":325}]}},{"cve":"CVE-2014-3608","published":"2014-10-06","fixed":"2014.1.3","kev":false}],"package":"PyPI:nova"}}