Описание
The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | 2:12.0.0-0ubuntu2 |
| esm-infra-legacy/trusty | DNE | trusty/esm was DNE [trusty was released [1:2014.1.5-0ubuntu1.7]] |
| esm-infra-legacy/xenial | not-affected | 2:12.0.0-0ubuntu2 |
| esm-infra/xenial | not-affected | 2:12.0.0-0ubuntu2 |
| precise | ignored | end of life |
| precise/esm | DNE | precise was needed |
| trusty | released | 1:2014.1.5-0ubuntu1.7 |
| trusty/esm | DNE | trusty was released [1:2014.1.5-0ubuntu1.7] |
| upstream | released | 2015.1.3,12.0.1 |
| vivid | ignored | end of life |
Показывать по
EPSS
4.3 Medium
CVSS2
5.9 Medium
CVSS3
Связанные уязвимости
The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.
The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.
The volume_utils._parse_volume_info function in OpenStack Compute (Nov ...
OpenStack Nova Potential Xen connection password leak via StorageError
ALT-PU-2016-3275: package `openstack-nova` update to version 12.0.2-alt1
EPSS
4.3 Medium
CVSS2
5.9 Medium
CVSS3