CVE-2013-7130: Nova OpenStack Nova Live Migration Can Vulnerability

Q: What is CVE-2013-7130?

CVE-2013-7130 is a security vulnerability in Nova involving OpenStack Nova Live migration can leak root disk into ephemeral storage under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Q: Which Nova versions are affected?

Affected versions include releases prior to 12.0.0a0 across affected packages: nova.

Q: What version fixes CVE-2013-7130?

Upgrading to 12.0.0a0 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is nova affected?

Yes, nova is affected in releases prior to 12.0.0a0. Upgrade your dependency to 12.0.0a0 or later.

Q: What is the CVSS score of CVE-2013-7130?

CVE-2013-7130 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Q: What CWE is associated with CVE-2013-7130?

CVE-2013-7130 is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.).

Q: How can I check PyPI dependencies for CVE-2013-7130?

Run the dependency tree command: 'pip show nova'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-99rx-9x8v-9j8p

CVSS 7.5

CWE-200

Published 2022-05-17

Advisory Summary

CVE-2013-7130 is a HIGH (CVSS 7.5) openstack nova live migration can vulnerability (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor) affecting Nova libraries in the PyPI ecosystem. The issue involves openstack nova live migration can leak root disk into ephemeral storage. Remediation is available by upgrading affected packages to version 12.0.0a0.

CVE-2013-7130 at a Glance

CVE Identifier CVE-2013-7130

GHSA Identifier GHSA-99rx-9x8v-9j8p

Severity HIGH

CVSS v3.1 Base Score 7.5

CWE Classification CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

Affected Product Nova

Package Ecosystem PyPI

Published Date 2022-05-17

Last Updated 2024-11-26

Security Impact

CVSS: 7.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity None (I:N)

Availability None (A:N)

How to Fix CVE-2013-7130

To remediate this vulnerability, upgrade all affected Nova dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

nova fixed: 12.0.0a0

pip install nova>=12.0.0a0

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

pip show nova

How to Check if You Are Affected

To determine whether your Python environment is affected by CVE-2013-7130, inspect your installed packages using pip:

pip show nova

Analyze the terminal output to locate any version of Nova in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 12.0.0a0), your application is affected.

Note: The pip show nova command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, where the product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. In Nova, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage.

CVE-2013-7130 Affected Nova Versions

1 component(s)

Fixed Versions:

12.0.0a0

Product / Package	Ecosystem	Affected Versions	Fixed Version
nova pypi/nova	PyPI	< 12.0.0a0	12.0.0a0

References

NVD — CVE-2013-7130 NVD

https://nvd.nist.gov/vuln/detail/CVE-2013-7130

Security Fix Commit FIX COMMIT

https://github.com/openstack/nova/commit/15ee7e17f63f5583307a546ecf28952c364c88f9

Security Fix Commit FIX COMMIT

https://github.com/openstack/nova/commit/b0d36683fe064b32cbef013e1c0c46bd018ab9a1

Security Fix Commit FIX COMMIT

https://github.com/openstack/nova/commit/cbeb5e51886b0296349fc476305bfe3d63c627c3

bugs.launchpad.net/nova/+bug/1251590 WEB

https://bugs.launchpad.net/nova/+bug/1251590

exchange.xforce.ibmcloud.com/vulnerabilities/906... WEB

https://exchange.xforce.ibmcloud.com/vulnerabilities/90652

Nova Source Repository REPOSITORY

https://github.com/openstack/nova

Nova Source Repository REPOSITORY

https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2014-111.yaml

review.openstack.org/ WEB

https://review.openstack.org/#/c/68658

review.openstack.org/ WEB

https://review.openstack.org/#/c/68659

review.openstack.org/ WEB

https://review.openstack.org/#/c/68660

lists.fedoraproject.org/pipermail/package-a... WEB

http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.html

lists.fedoraproject.org/pipermail/package-a... WEB

http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127735.html

osvdb.org/102416 WEB

http://osvdb.org/102416

rhn.redhat.com/errata/rhsa-2014-02... WEB

http://rhn.redhat.com/errata/RHSA-2014-0231.html

Nova Security Information SECURITY

http://www.openwall.com/lists/oss-security/2014/01/23/5

www.ubuntu.com/usn/usn-2247-1 WEB

http://www.ubuntu.com/usn/USN-2247-1

Frequently Asked Questions

What is CVE-2013-7130?

CVE-2013-7130 is a security vulnerability in Nova involving OpenStack Nova Live migration can leak root disk into ephemeral storage under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Which Nova versions are affected?

Affected versions include releases prior to 12.0.0a0 across affected packages: nova.

What version fixes CVE-2013-7130?

Upgrading to 12.0.0a0 (or the latest patched release for your respective branch) resolves the vulnerability.

Is nova affected?

Yes, nova is affected in releases prior to 12.0.0a0. Upgrade your dependency to 12.0.0a0 or later.

What is the CVSS score of CVE-2013-7130?

CVE-2013-7130 has a CVSS v3.1 base score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

What CWE is associated with CVE-2013-7130?

CVE-2013-7130 is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.).

How can I check PyPI dependencies for CVE-2013-7130?

Run the dependency tree command: 'pip show nova'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-99rx-9x8v-9j8p",
  "modified" : "2024-11-26T18:16:49Z",
  "published" : "2022-05-17T01:29:42Z",
  "aliases" : [ "CVE-2013-7130" ],
  "summary" : "OpenStack Nova Live migration can leak root disk into ephemeral storage",
  "details" : "The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver in OpenStack Compute (Nova) Grizzly, Havana, and Icehouse, when using KVM live block migration, does not properly create all expected files, which allows attackers to obtain snapshot root disk contents of other users via ephemeral storage.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
  }, {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "nova"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "12.0.0a0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2013-7130"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openstack/nova/commit/15ee7e17f63f5583307a546ecf28952c364c88f9"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openstack/nova/commit/b0d36683fe064b32cbef013e1c0c46bd018ab9a1"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/openstack/nova/commit/cbeb5e51886b0296349fc476305bfe3d63c627c3"
  }, {
    "type" : "WEB",
    "url" : "https://bugs.launchpad.net/nova/+bug/1251590"
  }, {
    "type" : "WEB",
    "url" : "https://exchange.xforce.ibmcloud.com/vulnerabilities/90652"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/openstack/nova"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2014-111.yaml"
  }, {
    "type" : "WEB",
    "url" : "https://review.openstack.org/#/c/68658"
  }, {
    "type" : "WEB",
    "url" : "https://review.openstack.org/#/c/68659"
  }, {
    "type" : "WEB",
    "url" : "https://review.openstack.org/#/c/68660"
  }, {
    "type" : "WEB",
    "url" : "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127732.html"
  }, {
    "type" : "WEB",
    "url" : "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127735.html"
  }, {
    "type" : "WEB",
    "url" : "http://osvdb.org/102416"
  }, {
    "type" : "WEB",
    "url" : "http://rhn.redhat.com/errata/RHSA-2014-0231.html"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2014/01/23/5"
  }, {
    "type" : "WEB",
    "url" : "http://www.ubuntu.com/usn/USN-2247-1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-200" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2024-05-14T21:27:09Z",
    "nvd_published_at" : "2014-02-06T17:00:00Z"
  }
}

CVSS V3

7.5 HIGH

Attack Vector Network (AV:N)

Attack Complexity Low (AC:L)

Privileges Required None (PR:N)

User Interaction None (UI:N)

Scope Unchanged (S:U)

Confidentiality High (C:H)

Integrity None (I:N)

Availability None (A:N)

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Advisory Metadata

Source ID: GHSA-99rx-9x8v-9j8p
Schema Version: 1.4.0
Published: 2022-05-17 01:29
Last Modified: 2024-11-26 18:16
Database Record File: advisories/github-reviewed/2022/05/GHSA-99rx-9x8v-9j8p/GHSA-99rx-9x8v-9j8p.json