{"id":"DEBIAN-CVE-2013-4202","details":"The (1) backup (api/contrib/backups.py) and (2) volume transfer (contrib/volume_transfer.py) APIs in OpenStack Cinder Grizzly 2013.1.3 and earlier allows remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.  NOTE: this issue is due to an incomplete fix for CVE-2013-1664.","modified":"2026-09-01T20:03:17.539241042Z","published":"2013-09-16T19:14:38.833Z","upstream":["CVE-2013-4202"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2013-4202"}],"affected":[{"package":{"name":"cinder","ecosystem":"Debian:12","purl":"pkg:deb/debian/cinder?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2013.1.2-4"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2013-4202.json"}},{"package":{"name":"cinder","ecosystem":"Debian:13","purl":"pkg:deb/debian/cinder?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2013.1.2-4"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2013-4202.json"}},{"package":{"name":"cinder","ecosystem":"Debian:14","purl":"pkg:deb/debian/cinder?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2013.1.2-4"}]}],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2013-4202.json"}}],"schema_version":"1.9.0"}