ALT-PU-2016-3275

Низкий

ALT-PU-2016-3275: package openstack-nova update to version 12.0.2-alt1

Источник

errata.altlinux.org

Дата публикации

28.03.2016

Дата обновления

28.03.2016

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades openstack-nova to version 12.0.2-alt1.

Устраненные уязвимости2

CVE-2015-7548

Низкий 3.5

Дата публикации: 12.01.2016

CWE-200

OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty), when using libvirt to spawn instances and use_cow_images is set to false, allow remote authenticated users to read arbitrary files by overwriting an instance disk with a crafted image and requesting a snapshot.

CVSS 3.0

Низкий 3.5

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

Attack vector: Network
Complexity: High
Privileges: Low
User interaction: None
Scope: Changed
Confidentiality: Low
Integrity: None
Availability: None

CVSS 2.0

Низкий 2.1

AV:N/AC:H/Au:S/C:P/I:N/A:N

Access vector: Network
Complexity: High
Authentication: Single
Confidentiality: Partial
Integrity: None
Availability: None

Ссылки

CVE-2015-7548 https://nvd.nist.gov/vuln/detail/CVE-2015-7548

Ссылки2

ALT-PU-2016-3275 https://errata.altlinux.org/ALT-PU-2016-3275

GHSA-c36r-g737-9qp8

https://github.com/advisories/GHSA-c36r-g737-9qp8

Связанные уязвимости

CVE-2015-8749

CVSS3: 5.9

ubuntu

почти 11 лет назад

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.