CVE-2013-2030

Severity CVSS v4.0:

Pending analysis

Type:

CWE-264 Permissions, Privileges, and Access Control

Publication date:

27/12/2013

Last modified:

11/04/2025

Description

keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.

Impact

Vector 2.0

AV:L/AC:L/Au:N/C:N/I:P/A:N CVSS v2.0 Severity and Metrics:

Base Score: 2.10 LOW
Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N

Attack Vector (AV): Local
Attack Complexity (AC): Low
Authentication (Au): None
Confidentiality (C): None
Integrity (I): Physical
Availability (A): None

Base Score 2.0

2.10

Severity 2.0

LOW

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:openstack:compute:2013.1:::::::*
cpe:2.3:a:openstack:compute:2013.1.1:::::::*
cpe:2.3:a:openstack:compute:2013.1.2:::::::*
cpe:2.3:a:openstack:compute:2013.1.3:::::::*
cpe:2.3:a:openstack:folsom:-:::::::*
cpe:2.3:a:openstack:grizzly:2013.1:::::::*
cpe:2.3:a:openstack:havana:havana-1:::::::*
cpe:2.3:a:openstack:havana:havana-2:::::::*
cpe:2.3:a:openstack:havana:havana-3:::::::*

To consult the complete list of CPE names with products and versions, see this page

CPE	From	Up to
cpe:2.3:a:openstack:compute:2013.1:::::::*
cpe:2.3:a:openstack:compute:2013.1.1:::::::*
cpe:2.3:a:openstack:compute:2013.1.2:::::::*
cpe:2.3:a:openstack:compute:2013.1.3:::::::*
cpe:2.3:a:openstack:folsom:-:::::::*
cpe:2.3:a:openstack:grizzly:2013.1:::::::*
cpe:2.3:a:openstack:havana:havana-1:::::::*
cpe:2.3:a:openstack:havana:havana-2:::::::*
cpe:2.3:a:openstack:havana:havana-3:::::::*

CVE-2013-2030

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools