CVE-2015-8749

Published: 15 January 2016

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.

Priority

Medium

CVSS 3 base score: 5.9

Status

Package Release Status
nova
Launchpad, Ubuntu, Debian
Upstream
Released (2015.1.3,12.0.1)
Ubuntu 16.04 LTS (Xenial Xerus) Not vulnerable
(2:12.0.0-0ubuntu2)
Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was released [1:2014.1.5-0ubuntu1.7])