CVE-2013-4261

Name	CVE-2013-4261
Description	OpenStack Compute (Nova) Folsom, Grizzly, and earlier, when using Apache Qpid for the RPC backend, does not properly handle errors that occur during messaging, which allows remote attackers to cause a denial of service (connection pool consumption), as demonstrated using multiple requests that send long strings to an instance console and retrieving the console log.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nova (PTS)	buster	2:18.1.0-6	fixed
	buster (security)	2:18.1.0-6+deb10u2	fixed
	bullseye (security), bullseye	2:22.0.1-2+deb11u1	fixed
	bookworm, sid	2:26.1.0-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
nova	source	(unstable)	2013.2-1	low

Notes

[wheezy] - nova <no-dsa> (Will be fixed in a point update)
https://bugs.launchpad.net/nova/+bug/1215091/comments/10 (relevant question for other components)
probably does not affect Essex/2012.1, see https://bugs.launchpad.net/nova/+bug/1215091/comments/6