PT-2016-3997 · Openstack+1 · Openstack Compute+1

Matt Riedemann · Publicado 2016-01-15 · Atualizado 2022-05-14 · CVE-2015-8749

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Compute (Nova) versions prior to 2015.1.3 (kilo) OpenStack Compute (Nova) versions 12.0.x prior to 12.0.1 (liberty)

Description The issue concerns the volume utils. parse volume info function, which includes the connection info dictionary in the StorageError message when using the Xen backend. This might allow attackers to obtain sensitive password information by reading log files.

Recommendations For versions prior to 2015.1.3 (kilo), update to version 2015.1.3 or later. For versions 12.0.x prior to 12.0.1 (liberty), update to version 12.0.1 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-8749

GHSA-C36R-G737-9QP8

USN-3449-1

Produtos afetados

Openstack Compute

Ubuntu

Referências · 27

• https://github.com/openstack/nova · Nota
• https://github.com/openstack/nova/commit/ef1ccdaca9512b88878155f7d8c2c77853d91252 · Nota
• https://github.com/openstack/nova/commit/8b289237ed6d53738c22878decf0c429301cf3d0 · Nota
• https://github.com/openstack/nova/commit/b2acc9fa864b6fe10bc0c5f3786b976b472b1b27 · Nota
• https://github.com/openstack/nova/commit/cf197ec2d682fb4da777df2291ca7ef101f73b77 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-8749 · Nota de Segurança
• https://security.openstack.org/ossa/OSSA-2016-002.html · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-3449-1 · Aviso do Fabricante
• http://securityfocus.com/bid/80189 · Nota
• https://ubuntu.com/security/CVE-2016-2140 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-7713 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-3241 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-8749 · Nota de Segurança
• http://openwall.com/lists/oss-security/2016/01/07/8 · Nota
• http://openwall.com/lists/oss-security/2016/01/07/9 · Nota