Product: Apache CloudStack

Vendor: Apache Software Foundation

Vulnerability type: Bypass

Vulnerable Versions: Apache CloudStack 4.1.0, 4.1.1, 4.2.0

CVE References: CVE-2013-2136

Risk Level: Low

CVSSv2 Base Scores: 2.8 (AV:N/AC:M/Au:M/C:P/I:N/A:N)

Description:

The Apache CloudStack Security Team was notified of a an issue in the Apache CloudStack virtual router that failed to preserve source restrictions in firewall rules after a virtual router had been stopped and restarted.

Mitigation:

Upgrading to CloudStack 4.2.1 or higher will mitigate this issue.

References:

https://issues.apache.org/jira/browse/CLOUDSTACK-5263

Credit:

This issue was identified by the Cloud team at Schuberg Philis