Skip to content
OpenAdvisories
Medium RHSA-2013:1198 2 CVEs

Red Hat Security Advisory: openstack-cinder security update

Published Sep 15, 2024 · Updated Aug 1, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · OpenStack 3 openstack:3::el6 openstack-cinder 0:2013.1.3-2.el6ost
Red Hat · OpenStack 3 openstack:3::el6 openstack-cinder-doc 0:2013.1.3-2.el6ost
Red Hat · OpenStack 3 openstack:3::el6 python-cinder 0:2013.1.3-2.el6ost

Vulnerabilities 2

  • Medium 6.2
    CVE-2013-4183

    OpenStack Cinder LVMVolumeDriver does not zero deleted snapshots

    The clear_volume function in LVMVolumeDriver driver in OpenStack Cinder 2013.1.1 through 2013.1.2 does not properly clear data when deleting a snapshot, which allows local users to obtain sensitive information via unspecified vectors.

    cinder cinder Debian PyPI
  • Medium —
    CVE-2013-4202

    OpenStack Cinder Denial of Service using XML entities

    The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansio…

    cinder cinder Debian PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://rhn.redhat.com/errata/RHSA-2013-0658.html
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=975916
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=991630
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=994355
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1198.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-4183
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4183
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4183
  • report
    https://access.redhat.com/security/cve/CVE-2013-4202
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4202
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4202