PyPI: nova
CVE-2015-8749
Safety vulnerability ID: SFTY-20160115-99158
Safety legacy ID: pyup.io-70436
The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.
Overview
OpenStack Nova Potential Xen connection password leak via StorageError
Advisory
The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20160115-99158/CVE-2015-8749
- https://nvd.nist.gov/vuln/detail/CVE-2015-8749
- https://bugs.launchpad.net/nova/+bug/1516765
- https://security.openstack.org/ossa/OSSA-2016-002.html
- http://www.openwall.com/lists/oss-security/2016/01/07/8
- http://www.openwall.com/lists/oss-security/2016/01/07/9
- http://www.securityfocus.com/bid/80189
- https://github.com/openstack/nova/commit/8b289237ed6d53738c22878decf0c429301cf3d0
- https://github.com/openstack/nova/commit/b2acc9fa864b6fe10bc0c5f3786b976b472b1b27
- https://github.com/openstack/nova/commit/cf197ec2d682fb4da777df2291ca7ef101f73b77
- https://github.com/openstack/nova/commit/ef1ccdaca9512b88878155f7d8c2c77853d91252
- https://github.com/advisories/GHSA-c36r-g737-9qp8
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more