Every CVESearch/Get API key

CVE-2013-4179

OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack

4.3 MediumFix available

CVE-2013-4179 is a medium vulnerability (CVSS 4.3) in Openstack Compute, published September 16, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.73%, the 86th percentile. Fixed in nova 2013.2.

What does this mean?
Severity
4.3 MediumCVSS 2.0, NVD
Exploit chance
2.73%EPSS, 86th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
2013.2nova +17 more

Description

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Exploit likelihood

2.73%Up 1.6 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nova
PyPI
through 2013.1.3
2013.2
nova
Debian:12
before 2013.1.3-1
2013.1.3-1
nova
Debian:13
before 2013.1.3-1
2013.1.3-1
nova
Debian:14
before 2013.1.3-1
2013.1.3-1
nova
PyPI
before 2013.2, plus listed versions
15.1.516.1.616.1.716.1.817.0.10
Show 45 moreShow less
17.0.1117.0.1217.0.1317.0.717.0.817.0.918.0.218.0.318.1.018.2.018.2.118.2.218.2.318.3.019.0.019.0.0.0rc119.0.0.0rc219.0.119.0.219.0.319.1.019.2.019.3.019.3.119.3.220.0.020.0.0.0rc120.0.0.0rc220.0.120.1.020.1.120.2.020.3.020.4.020.4.120.5.020.6.020.6.121.0.021.0.0.0rc121.0.0.0rc221.1.021.1.121.1.221.2.0
2013.2
openstack-nova
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-api
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-cells
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-cert
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-common
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
Show 8 moreShow less
Affected packages
PackageAffectedFixed
openstack-nova-compute
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-conductor
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-console
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-doc
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-network
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-objectstore
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-scheduler
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
python-nova
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost

What each source reports

NVD Score used4.3

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Record
CVE-2013-4179
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE ListNo score

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Record
CVE-2013-4179
Updated
2026-11-02
EUVDEUVD-2022-4295No score

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Record
EUVD-2022-4295
Updated
2026-11-03
GitHub AdvisoriesGHSA-j6xh-q826-55jwNo score

OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Record
GHSA-j6xh-q826-55jw
Weakness
CWE-119
Updated
2026-11-02
OSVNo score

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Record
CVE-2013-4179
Updated
2026-11-02
OSVDEBIAN-CVE-2013-4179No score

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Record
DEBIAN-CVE-2013-4179
Updated
2026-11-02
OSVGHSA-j6xh-q826-55jwNo score

OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Record
GHSA-j6xh-q826-55jw
Weakness
CWE-119
Updated
2026-11-02
OSVPYSEC-2026-875No score

OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Record
PYSEC-2026-875
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 26 moreShow less
This page doesn't list everything

Left out here: 93 versions. The JSON record has them.

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open