CVE-2015-8749 OpenStack Nova Potential Xen connection password leak via StorageError
Attackers can obtain sensitive password information from log files in OpenStack Compute when using the Xen backend.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-8749?
CVE-2015-8749 is a medium-severity vulnerability in n/a, published on 15 Jan 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.
Weakness: CWE-200
Which versions are affected by CVE-2015-8749?
3 open source packages ship an affected version, including nova. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nova PyPI | From 12.0.0 | 12.0.1 |
nova PyPI | From 12.0.0 | 12.0.1 |
nova PyPI | From 12.0.0 | 12.0.1 |
Products include Openstack Nova.
How do I fix CVE-2015-8749?
Upgrade nova to 12.0.1 or later.
Is CVE-2015-8749 being exploited?
There is no known exploitation of CVE-2015-8749 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2017-7214 OpenStack Nova logs sensitive context from notification exceptions
- CVE-2017-17051 OpenStack Nova DoS by rebuilding the same instance with a new image multiple times
- CVE-2020-17376 OpenStack Nova Live migration fails to update persistent domain XML
- CVE-2017-18191 OpenStack Nova Denial of service attack on the compute host
- CVE-2015-3280 OpenStack Compute (nova) allows remote authenticated users to cause a denial of service
Sources
Also known as DEBIAN-CVE-2015-8749, GHSA-c36r-g737-9qp8, PYSEC-2026-870, UBUNTU-CVE-2015-8749.