============================================================================ Ubuntu Security Notice USN-1731-1 February 21, 2013 cinder vulnerability ============================================================================ A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 12.10 Summary: Cinder could be made to crash if it received specially crafted input. Software Description: - cinder: Cinder storage service - api server Details: Stuart Stent discovered that Cinder would allow XML entity processing. A remote unauthenticated attacker could exploit this using the Cinder API to cause a denial of service via resource exhaustion. (CVE-2013-1664) Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 12.10: python-cinder 2012.2.1-0ubuntu1.1 In general, a standard system update will make all the necessary changes. References: http://www.ubuntu.com/usn/usn-1731-1 CVE-2013-1664 Package Information: https://launchpad.net/ubuntu/+source/cinder/2012.2.1-0ubuntu1.1