CVE-2015-8749
Published: 15 January 2016
The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.
Priority
Status
Package | Release | Status |
---|---|---|
nova Launchpad, Ubuntu, Debian |
precise |
Ignored
(end of life)
|
trusty |
Released
(1:2014.1.5-0ubuntu1.7)
|
|
upstream |
Released
(2015.1.3,12.0.1)
|
|
vivid |
Ignored
(end of life)
|
|
wily |
Not vulnerable
(2:12.0.0-0ubuntu2)
|
|
xenial |
Not vulnerable
(2:12.0.0-0ubuntu2)
|
|
yakkety |
Not vulnerable
(2:12.0.0-0ubuntu2)
|
|
zesty |
Not vulnerable
(2:12.0.0-0ubuntu2)
|
Severity score breakdown
Parameter | Value |
---|---|
Base score | 5.9 |
Attack vector | Network |
Attack complexity | High |
Privileges required | None |
User interaction | None |
Scope | Unchanged |
Confidentiality | High |
Integrity impact | None |
Availability impact | None |
Vector | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N |