CVE-2015-8749
published 2016-01-15CVE-2015-8749: The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info…
medium5.9CVSS 3.0
AVNACHPRNUINSUCHINAN
The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | nova | < nova 2:13.0.0~rc3-1 (bookworm) | nova 2:13.0.0~rc3-1 (bookworm) |
| openstack | nova | >= 0 < 2:13.0.0~rc3-1 | 2:13.0.0~rc3-1 |
| openstack | nova | >= 0 < 2:13.0.0~rc3-1 | 2:13.0.0~rc3-1 |
| openstack | nova | >= 0 < 2:13.0.0~rc3-1 | 2:13.0.0~rc3-1 |
| openstack | nova | >= 0 < 2:13.0.0~rc3-1 | 2:13.0.0~rc3-1 |
| openstack | nova | >= 0 < 1:2014.1.5-0ubuntu1.7 | 1:2014.1.5-0ubuntu1.7 |
| openstack | nova | >= 12.0.0 < 12.0.1 | 12.0.1 |
| openstack | nova | >= 12.0.0 < 12.0.1 | 12.0.1 |
| openstack | nova | >= 2015.1.0 < 2015.1.3 | 2015.1.3 |
CVSS provenance
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
osv6.8MEDIUM