PT-2019-13694 · Openstack+1 · Openstack Nova+1

Donny Davis · Published 2019-08-06 · Updated 2022-10-27 · CVE-2019-14433

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Nova versions prior to 17.0.12 OpenStack Nova versions 18.x prior to 18.2.2 OpenStack Nova versions 19.x prior to 19.0.2

Description An issue in OpenStack Nova may leak details of the underlying environment in the response to an API request from an authenticated user if the request ends in a fault condition due to an external exception. This could include sensitive configuration or other data.

Recommendations For OpenStack Nova versions prior to 17.0.12, update to version 17.0.12 or later. For OpenStack Nova versions 18.x prior to 18.2.2, update to version 18.2.2 or later. For OpenStack Nova versions 19.x prior to 19.0.2, update to version 19.0.2 or later.

Fix

Information Disclosure

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-200

CWE-209

Related Identifiers

CVE-2019-14433

DLA-3109-1

GHSA-PG64-R7RR-PHV8

PYSEC-2019-191

RHSA-2019:2622

RHSA-2019:2631

RHSA-2019:2652

USN-4104-1

Affected Products

Openstack Nova

Ubuntu

References · 24

• https://osv.dev/vulnerability/PYSEC-2019-191 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-14433 · Vendor Advisory
• https://launchpad.net/bugs/1837877 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2019-14433 · Security Note
• https://usn.ubuntu.com/4104-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pg64-r7rr-phv8 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2631 · Vendor Advisory
• https://security.openstack.org/ossa/OSSA-2019-003.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-4104-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2652 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2622 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-14433 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-14433 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-14433 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3109-1 · Vendor Advisory