CVE-2013-6426

Impact:
Moderate
Public Date:
2013-12-11
Bugzilla:
1039141: CVE-2013-6426 OpenStack Heat: CFN policy rules not all enforced

The MITRE CVE dictionary describes this issue as:

The cloudformation-compatible API in OpenStack Orchestration API (Heat) before Havana 2013.2.1 and Icehouse before icehouse-2 does not properly enforce policy rules, which allows local in-instance users to bypass intended access restrictions and (1) create a stack via the CreateStack method or (2) update a stack via the UpdateStack method.

Find out more about CVE-2013-6426 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v2 metrics

Base Score 4
Base Metrics AV:N/AC:L/Au:S/C:N/I:P/A:N
Access Vector Network
Access Complexity Low
Authentication Single
Confidentiality Impact None
Integrity Impact Partial
Availability Impact None

Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).

Red Hat Security Errata

Platform Errata Release Date
Red Hat Enterprise Linux OpenStack Platform 4.0 (openstack-heat) RHSA-2014:0090 2014-01-22

Affected Packages State

Platform Package State
Red Hat Enterprise Linux OpenStack Platform 3.0 openstack-heat Will not fix

Acknowledgements

Red Hat would like to thank Jeremy Stanley of the OpenStack Project for reporting this issue. Upstream acknowledges Steven Hardy of Red Hat as the original reporter.

Last Modified

CVE description copyright © 2017, The MITRE Corporation

Close

Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.