OpenStack Nova Potential Xen connection password leak via StorageError
The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2015-8749US | medium5.9 | — | ||
The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the St… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2016/01/07/8WEB
- http://www.openwall.com/lists/oss-security/2016/01/07/9WEB
- http://www.securityfocus.com/bid/80189WEB
- https://bugs.launchpad.net/nova/+bug/1516765WEB
- https://github.com/openstack/novaPACKAGE
- https://github.com/openstack/nova/commit/8b289237ed6d53738c22878decf0c429301cf3d0WEB
- https://github.com/openstack/nova/commit/b2acc9fa864b6fe10bc0c5f3786b976b472b1b27WEB
- https://github.com/openstack/nova/commit/cf197ec2d682fb4da777df2291ca7ef101f73b77WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan