Every CVE Search/ Get API key

CVE-2013-4179

OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack

4.3 MediumFix available

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Exploit likelihood

2.73%Up 1.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 4.3

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Record
CVE-2013-4179
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:N/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Record
CVE-2013-4179
Updated
2026-11-02
EUVDEUVD-2022-4295 No score

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Record
EUVD-2022-4295
Updated
2026-11-03
GitHub AdvisoriesGHSA-j6xh-q826-55jw No score

OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Record
GHSA-j6xh-q826-55jw
Weakness
CWE-119
Updated
2026-11-02
OSV No score

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Record
CVE-2013-4179
Updated
2026-11-02
OSVDEBIAN-CVE-2013-4179 No score

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Record
DEBIAN-CVE-2013-4179
Updated
2026-11-02
OSVGHSA-j6xh-q826-55jw No score

OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Record
GHSA-j6xh-q826-55jw
Weakness
CWE-119
Updated
2026-11-02
OSVPYSEC-2026-875 No score

OpenStack Compute (Nova) vulnerable to denial of service via XML Entity Expansion attack

The security group extension in OpenStack Compute (Nova) Grizzly 2013.1.3, Havana before havana-3, and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack. NOTE: this issue is due to an incomplete fix for CVE-2013-1664.

Record
PYSEC-2026-875
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nova
PyPI
 through 2013.1.3
2013.2
nova
Debian:12
 before 2013.1.3-1
2013.1.3-1
nova
Debian:13
 before 2013.1.3-1
2013.1.3-1
nova
Debian:14
 before 2013.1.3-1
2013.1.3-1
nova
PyPI
 before 2013.2, plus listed versions
15.1.516.1.616.1.716.1.817.0.10
Show 45 moreShow less
17.0.1117.0.1217.0.1317.0.717.0.817.0.918.0.218.0.318.1.018.2.018.2.118.2.218.2.318.3.019.0.019.0.0.0rc119.0.0.0rc219.0.119.0.219.0.319.1.019.2.019.3.019.3.119.3.220.0.020.0.0.0rc120.0.0.0rc220.0.120.1.020.1.120.2.020.3.020.4.020.4.120.5.020.6.020.6.121.0.021.0.0.0rc121.0.0.0rc221.1.021.1.121.1.221.2.0
2013.2
openstack-nova
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-api
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-cells
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-cert
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-common
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
Show 8 moreShow less
Affected packages
PackageAffectedFixed
openstack-nova-compute
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-conductor
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-console
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-doc
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-network
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-objectstore
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
openstack-nova-scheduler
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost
python-nova
Red Hat:openstack:3::el6
From an advisory covering 4 CVEs
 before 0:2013.1.3-3.el6ost
0:2013.1.3-3.el6ost

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-4179 is a medium vulnerability (CVSS 4.3) in Openstack Compute, published September 16, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.73%, the 86th percentile. Fixed in nova 2013.2.

References

Show 26 moreShow less
This page doesn't list everything

Left out here: 93 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open