Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
2.1
CVSSv2

CVE-2013-2030

Published: 27/12/2013 Updated: 05/05/2014
CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9
VMScore: 187
Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N
Subscribe to Compute

Vulnerability Summary

keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.

Vulnerable Product Search on Vulmon Subscribe to Product

openstack compute 2013.1.2

openstack compute 2013.1.3

openstack havana havana-1

openstack havana havana-2

openstack havana havana-3

openstack grizzly 2013.1

openstack compute 2013.1

openstack compute 2013.1.1

openstack folsom -

Vendor Advisories

Debian CVElist Bug Report Logs: CVE-2013-2096
Debian Bug report logs - #710157 CVE-2013-2096 Package: nova; Maintainer for nova is Debian OpenStack <team+openstack@trackerdebianorg>; Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Tue, 28 May 2013 16:30:05 UTC Severity: grave Tags: security Fixed in version nova/201312-2 Done: Thomas Goirand <zig ...
Red Hat: CVE-2013-2030
keystone/middleware/auth_tokenpy in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora ...

References

CWE-264http://www.openwall.com/lists/oss-security/2013/05/09/2http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=958285https://bugs.launchpad.net/nova/+bug/1174608http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.htmlhttps://bugs.debian.org/cgi-bin/bugreport.cgi?bug=710157https://nvd.nist.govhttps://access.redhat.com/security/cve/cve-2013-2030
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-27322CVE-2006-4304wirelessCVE-2023-23022local file inclusionCVE-2024-27058CVE-2024-33820open redirectCVE-2024-27079
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook