OpenStack Compute (Nova) allows remote authenticated users to obtain sensitive information

published 2013-09-16 13 y ago modified 2026-09-10 1 mo ago also GHSA-5mj6-643f-2g85 , PYSEC-2026-866 , EUVD-2022-2621

cvss: 6.0; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.8%; EPSS 1.8% chance of exploitation in 30 days, percentile 79%
public exploits: 0; none known

OpenStack Compute (Nova) before 2013.1.3 and Havana before havana-2 does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to obtain sensitive information (flavor properties), boot arbitrary flavors, and possibly have other unspecified impacts by guessing the flavor id.

Patch / fix

fixed in 2 distros 2 links 1

pypi nova 2013.1.3
openstack nova 2013.1.3

debian red hat

nova Debian 14, Debian 13, Debian 12 2013.1.2-3

debian advisories DEBIAN-CVE-2013-2256

openstack-nova openstack 3 2013.1.3-3.el6ost
python-nova openstack 3 2013.1.3-3.el6ost
openstack-nova-api openstack 3 2013.1.3-3.el6ost
openstack-nova-cert openstack 3 2013.1.3-3.el6ost
openstack-nova-cells openstack 3 2013.1.3-3.el6ost
openstack-nova-common openstack 3 2013.1.3-3.el6ost
openstack-nova-compute openstack 3 2013.1.3-3.el6ost
openstack-nova-console openstack 3 2013.1.3-3.el6ost

red hat advisories RHSA-2013:1199

seclists.org/oss-sec/2013/q3/281 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2013-2256 updated 2026-07-31 cvss 5.5

OpenStack: Nova private flavors resource limit circumvention

Red Hat OpenStack Platform 4 openstack-nova
affected: no fix available
Red Hat Enterprise Linux OpenStack Platform 3.0 python-nova 2013.1.3-3.el6ost, openstack-nova 2013.1.3-3.el6ost, openstack-nova-api 2013.1.3-3.el6ost, openstack-nova-cert 2013.1.3-3.el6ost, openstack-nova-cells 2013.1.3-3.el6ost, openstack-nova-common 2013.1.3-3.el6ost, +6 more
fixed: vendor fix RHSA-2013:1199

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.84% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

bugs.launchpad.net https://bugs.launchpad.net/nova/+bug/1194093 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	6.0	AV:N/AC:M/Au:S/C:P/I:P/A:P

Affected packages

ecosystem	package	affected	fixed in
pypi	nova	<2013.1.3	2013.1.3

Classification

Weakness

CWE-264 Permissions, Privileges, and Access Controls

References

seclists.org /oss-sec/2013/q3/281
mailing-list, web, patch, third-party-advisory
bugs.launchpad.net /nova/+bug/1194093
web, exploit, third-party-advisory
rhn.redhat.com /errata/RHSA-2013-1199.html
vendor-advisory, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2013-2256
advisory
access.redhat.com /errata/RHSA-2013:1199
web
access.redhat.com /security/cve/CVE-2013-2256
web
bugzilla.redhat.com /show_bug.cgi?id=993340
web
opendev.org /openstack/nova
package
pypi.org /project/nova
package
github.com /advisories/GHSA-5mj6-643f-2g85
advisory

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary