Updated [CVE-2014-0031] CloudStack ListNetworkACL API discloses ACLs for other users
Issued: January 9, 2014 Updated: January 10, 2014 [CVE-2014-0031] CloudStack ListNetworkACL API discloses ACLs for other users Product: Apache CloudStack Vendor: Apache Software Foundation Vulnerability type: Information Disclosure Vulnerable Versions: Apache CloudStack 4.2.0 CVE References: CVE-2014-0031 Risk Level: Low CVSSv2 Base Scores: 3.5 (AV:N/AC:M/Au:S/C:P/I:N/A:N) Description: The Apache CloudStack Security Team was notified of a an issue in Apache CloudStack which permits an authenticated user to list network ACLs for other users. Mitigation: Upgrading to CloudStack 4.2.1 or higher will mitigate this issue. References: https://issues.apache.org/jira/browse/CLOUDSTACK-5145 Credit: This issue was identified by Marcus Sorensen
Updated [CVE-2013-6398] CloudStack Virtual Router stop/start modifies firewall rules allowing additional access
Issued: November 27, 2013 Updated: January 10, 2014 [CVE-2013-6398] CloudStack Virtual Router stop/start modifies firewall rules allowing additional access Product: Apache CloudStack Vendor: Apache Software Foundation Vulnerability type: Bypass Vulnerable Versions: Apache CloudStack 4.1.0, 4.1.1, 4.2.0 CVE References: CVE-2013-2136 Risk Level: Low CVSSv2 Base Scores: 2.8 (AV:N/AC:M/Au:M/C:P/I:N/A:N) Description: The Apache CloudStack Security Team was notified of a an issue in the Apache CloudStack virtual router that failed to preserve source restrictions in firewall rules after a virtual router had been stopped and restarted. Mitigation: Upgrading to CloudStack 4.2.1 or higher will mitigate this issue. References: https://issues.apache.org/jira/browse/CLOUDSTACK-5263 Credit: This issue was identified by the Cloud team and Schuberg Philis
