CVE-2013-6480 Libcloud does not properly scrub data when destroying a DigitalOcean node

Low 2.1 Published 7 Jan 2014 Updated 6 Aug 2024

Local attackers can recover sensitive data from destroyed DigitalOcean VMs because Libcloud fails to scrub data during destruction.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2013-6480?

CVE-2013-6480 is a low-severity vulnerability in n/a, published on 7 Jan 2014. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.

Weakness: CWE-200

Which versions are affected by CVE-2013-6480?

3 open source packages ship an affected version, including apache-libcloud. It affects 1 product.

Package	Affected	Fixed in
`apache-libcloud` PyPI	From `0.12.3`	`0.13.3`
`apache-libcloud` PyPI	From `0.12.3`	`0.13.3`
`apache-libcloud` PyPI	From `0.12.3`	`0.13.3`

Products include Apache Libcloud.

How do I fix CVE-2013-6480?

Upgrade apache-libcloud to 0.13.3 or later.

Is CVE-2013-6480 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2013-6480 exists.

Public exploit code: 1 Exploit-DB entry.

Sources

Also known as GHSA-g892-9h8m-r69r, PYSEC-2014-97.