CVE-2015-8749

Priority
Medium
Description
The volume_utils._parse_volume_info function in OpenStack Compute (Nova)
before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the
connection_info dictionary in the StorageError message when using the Xen
backend, which might allow attackers to obtain sensitive password
information by reading log files or other unspecified vectors.
References
Bugs
Assigned-to
mdeslaur
Package
Source: nova (LP Ubuntu Debian)
Upstream:released (2015.1.3,12.0.1)
Ubuntu 17.10 (Artful Aardvark):not-affected (2:12.0.0-0ubuntu2)
Ubuntu 12.04 ESM (Precise Pangolin):DNE (precise was needed)
Ubuntu 14.04 LTS (Trusty Tahr):released (1:2014.1.5-0ubuntu1.7)
Ubuntu Core 15.04:DNE
Ubuntu 16.04 LTS (Xenial Xerus):not-affected (2:12.0.0-0ubuntu2)
Ubuntu 17.04 (Zesty Zapus):not-affected (2:12.0.0-0ubuntu2)
More Information

Updated: 2017-10-11 14:14:42 UTC (commit 13496)