PT-2019-13694 · Openstack+1 · Openstack Nova+1

Donny Davis · Publicado 2019-08-06 · Atualizado 2022-10-27 · CVE-2019-14433

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Nova versions prior to 17.0.12 OpenStack Nova versions 18.x prior to 18.2.2 OpenStack Nova versions 19.x prior to 19.0.2

Description An issue in OpenStack Nova may leak details of the underlying environment in the response to an API request from an authenticated user if the request ends in a fault condition due to an external exception. This could include sensitive configuration or other data.

Recommendations For OpenStack Nova versions prior to 17.0.12, update to version 17.0.12 or later. For OpenStack Nova versions 18.x prior to 18.2.2, update to version 18.2.2 or later. For OpenStack Nova versions 19.x prior to 19.0.2, update to version 19.0.2 or later.

Correção

Information Disclosure

Generation of Error Message Containing Sensitive Information

Enumeração de Fraquezas

CWE-200

CWE-209

Identificadores relacionados

CVE-2019-14433

DLA-3109-1

GHSA-PG64-R7RR-PHV8

PYSEC-2019-191

RHSA-2019:2622

RHSA-2019:2631

RHSA-2019:2652

USN-4104-1

Produtos afetados

Openstack Nova

Ubuntu

Referências · 25

• https://github.com/openstack/nova · Nota
• https://github.com/openstack/nova/commit/298b337a16c0d10916b4431c436d19b3d6f5360e · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2019-191.yaml · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-14433 · Aviso do Fabricante
• https://security.openstack.org/ossa/OSSA-2019-003.html · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2019-14433 · Nota de Segurança
• https://usn.ubuntu.com/4104-1 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2019:2652 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-14433 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2019:2631 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14433 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2019:2622 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-14433 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2019-191 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2019/08/06/6 · Nota