CVE-2015-8749
Medium
Description
The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.
SeverityMedium
CVSS5.9
Exploit probability—
ProductOpenstack Nova
PublishedJan 15, 2016
First seenJan 15, 2016
How to fix
Update
- openstack nova12.0.1, 2015.1.3 or later
- nova12.0.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| openstack nova | 12.0.0 ≤ v < 12.0.1, 2015.1.0 ≤ v < 2015.1.3 | 12.0.1, 2015.1.3 |
| novaPyPI | 12.0.0 ≤ v < 12.0.1 | 12.0.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.