CVE-2011-4076
published 2019-11-26CVE-2011-4076: OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivalent to a…
medium5.9CVSS 3.1
AVNACHPRNUINSUCHINAN
OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivalent to a password). Exposing the EC2_ACCESS_KEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2_SECRET_KEY. An attacker could also presumably brute force values for EC2_ACCESS_KEY.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nova | < nova 2012.1~e1-1 (bookworm) | nova 2012.1~e1-1 (bookworm) |
| nova | nova | — | — |
| openstack | nova | >= 0 < 2012.1~e1-1 | 2012.1~e1-1 |
| openstack | nova | >= 0 < 2012.1~e1-1 | 2012.1~e1-1 |
| openstack | nova | >= 0 < 2012.1~e1-1 | 2012.1~e1-1 |
| openstack | nova | >= 0 < 2012.1~e1-1 | 2012.1~e1-1 |
| openstack | nova | >= 0 < 12.0.0a0 | 12.0.0a0 |
| openstack | nova | >= 2010.1 < 2012.1 | 2012.1 |
CVSS provenance
nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
osv5.9MEDIUM