OpenStack Nova Potential Xen connection password leak via StorageError
The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2015-8749US | medium5.9 | — | ||
The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the St… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2016/01/07/8WEB
- http://www.openwall.com/lists/oss-security/2016/01/07/9WEB
- http://www.securityfocus.com/bid/80189WEB
- https://bugs.launchpad.net/nova/+bug/1516765WEB
- https://github.com/advisories/GHSA-c36r-g737-9qp8ADVISORY
- https://github.com/openstack/novaPACKAGE
- https://github.com/openstack/nova/commit/8b289237ed6d53738c22878decf0c429301cf3d0WEB
- https://github.com/openstack/nova/commit/b2acc9fa864b6fe10bc0c5f3786b976b472b1b27WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan