{"id":"CVE-2013-2096","published":"2013-07-09T17:00:00Z","modified":"2024-08-06T15:27:40Z","title":"OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows…","vendor":null,"product":null,"tier":"tail","description":{"text":"OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not verify the virtual size of a QCOW2 image, which allows local users to cause a denial of service (host file system disk consumption) by creating an image with a large virtual size that does not contain a large amount of data.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.00386,"percentile":0.32573,"provenance":"source"},"cwes":[],"references":[{"url":"https://review.openstack.org/#/c/28717/","tags":["x_refsource_CONFIRM"]},{"url":"https://review.openstack.org/#/c/28901/","tags":["x_refsource_CONFIRM"]},{"url":"http://www.ubuntu.com/usn/USN-1831-1","tags":["vendor-advisory","x_refsource_UBUNTU"]},{"url":"http://lists.openstack.org/pipermail/openstack-announce/2013-May/000102.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://review.openstack.org/#/c/29192/","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/59924","tags":["vdb-entry","x_refsource_BID"]}],"priority":{"score":6.5,"factors":[{"name":"EPSS percentile","points":6.51}]},"affected":[{"ecosystem":"PyPI","package":"nova","vulnerableRanges":["<12.0.0a0"],"patched":["12.0.0a0"],"from":["GHSA-m674-hmx2-ffhq","PYSEC-2026-876"],"provenance":"source"}],"euvd":{"id":"EUVD-2013-2069","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-nova-cve-2013-2096","children":[{"from":"CVE-2013-2096","to":"CVE-2013-4463","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue is due to an incomplete fix for CVE-2013-2096.","from":"CVE.org","in":"CVE-2013-4463"},{"kind":"same-code","provenance":"machine","files":["nova/virt/libvirt/imagebackend.py"],"commits":["https://github.com/openstack/nova/commit/0caeb8eaf20abcdc77828f5c6b79fc104619e231","https://github.com/openstack/nova/commit/44a8aba1d5da87d54db48079103fdef946666d80","https://github.com/openstack/nova/commit/3cdfe894ab58f7b91bf7fb690fc5bc724e44066f","https://github.com/openstack/nova/commit/f6810be4ae1a6c93e7d8017ee67d5344dfdf4a30"],"basis":"shared function","functions":["copy_qcow2_image"]},{"kind":"similar","provenance":"machine","score":0.82,"basis":"same package + description similarity"}]},{"from":"CVE-2013-2096","to":"CVE-2013-4469","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"NOTE: this issue is due to an incomplete fix for CVE-2013-2096.","from":"CVE.org","in":"CVE-2013-4469"},{"kind":"same-code","provenance":"machine","files":["nova/virt/libvirt/imagebackend.py"],"commits":["https://github.com/openstack/nova/commit/0caeb8eaf20abcdc77828f5c6b79fc104619e231","https://github.com/openstack/nova/commit/44a8aba1d5da87d54db48079103fdef946666d80","https://github.com/openstack/nova/commit/3cdfe894ab58f7b91bf7fb690fc5bc724e44066f","https://github.com/openstack/nova/commit/135faa7b5d9855312bedc19e5e1ecebae34d3d18"],"basis":"shared function","functions":["copy_qcow2_image"]},{"kind":"similar","provenance":"machine","score":0.8,"basis":"same package + description similarity"}]}]}}