Candidate: CVE-2015-5160
PublicDate: 2018-08-20 21:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5160
 https://www.redhat.com/archives/libvir-list/2011-November/msg00853.html
Description:
 libvirt before 2.2 includes Ceph credentials on the qemu command line when
 using RADOS Block Device (aka RBD), which allows local users to obtain
 sensitive information via a process listing.
Ubuntu-Description:
Notes:
 tyhicks> libvirt and qemu need changes to securely pass passwords between
  themselves.
 mdeslaur> libvirt fix required qemu 2.6
 mdeslaur> we will not be fixing this minor issue in xenial and earlier.
Bugs:
 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2015-5160
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796111
Priority: low
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N [5.5 MEDIUM]

Patches_libvirt:
upstream_libvirt: released (2.2.0)
precise_libvirt: ignored (reached end-of-life)
precise/esm_libvirt: ignored
trusty_libvirt: ignored
trusty/esm_libvirt: ignored
vivid_libvirt: ignored (reached end-of-life)
vivid/stable-phone-overlay_libvirt: DNE
vivid/ubuntu-core_libvirt: DNE
wily_libvirt: ignored (reached end-of-life)
xenial_libvirt: ignored
esm-infra/xenial_libvirt: ignored
yakkety_libvirt: ignored (reached end-of-life)
zesty_libvirt: ignored (reached end-of-life)
artful_libvirt: not-affected (3.6.0-1ubuntu6)
devel_libvirt: not-affected (3.6.0-1ubuntu6)