CVE-2013-2030

2013-12-2701:55:05

CWE-264

[email protected]

web.nvd.nist.gov

openstack

nova

folsom

grizzly

havana

security

vulnerability

cve-2013-2030

nvd

2.1 Low

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:L/Au:N/C:N/I:P/A:N

6.1 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

5.1%

JSON

keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.

Affected configurations

NVD

Node

openstackcomputeMatch2013.1

openstackcomputeMatch2013.1.1

openstackcomputeMatch2013.1.2

openstackcomputeMatch2013.1.3

openstackfolsomMatch-

openstackgrizzlyMatch2013.1

openstackhavanaMatchhavana-1

openstackhavanaMatchhavana-2

openstackhavanaMatchhavana-3

CPENameOperatorVersion
openstack:computeopenstack computeeq2013.1
openstack:computeopenstack computeeq2013.1.1
openstack:computeopenstack computeeq2013.1.2
openstack:computeopenstack computeeq2013.1.3
openstack:folsomopenstack folsomeq-
openstack:grizzlyopenstack grizzlyeq2013.1
openstack:havanaopenstack havanaeqhavana-1
openstack:havanaopenstack havanaeqhavana-2
openstack:havanaopenstack havanaeqhavana-3

CPE	Name	Operator	Version
openstack:compute	openstack compute	eq	2013.1
openstack:compute	openstack compute	eq	2013.1.1
openstack:compute	openstack compute	eq	2013.1.2
openstack:compute	openstack compute	eq	2013.1.3
openstack:folsom	openstack folsom	eq	-
openstack:grizzly	openstack grizzly	eq	2013.1
openstack:havana	openstack havana	eq	havana-1
openstack:havana	openstack havana	eq	havana-2
openstack:havana	openstack havana	eq	havana-3