| Summary: | <sys-cluster/nova-12.0.0-r2: Xen connection password leak in logs via StorageError | ||
|---|---|---|---|
| Product: | Gentoo Security | Reporter: | Agostino Sarubbo <ago> |
| Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
| Status: | RESOLVED FIXED | ||
| Severity: | minor | CC: | openstack, prometheanfire |
| Priority: | Normal | ||
| Version: | unspecified | ||
| Hardware: | All | ||
| OS: | Linux | ||
| URL: | http://www.openwall.com/lists/oss-security/2016/01/07/8 | ||
| Whiteboard: | B3 [noglsa] | ||
| Package list: | Runtime testing required: | --- | |
arches, stablize =sys-cluster/nova-12.0.0-r2 amd64 stable x86 stable. Maintainer(s), please cleanup. Security, please vote. cleaned up |
From ${URL} : A vulnerability was discovered in OpenStack (see below). In order to ensure full traceability, we need a CVE number assigned that we can attach to further notifications. This issue is already public, although an advisory was not sent yet. Title: Xen connection password leak in logs via StorageError Reporter: Matt Riedemann (IBM) Products: Nova Affects: >= 2014.2 <= 2015.1.2, ==12.0.0 Description: Matt Riedemann from IBM reported an information disclosure vulnerability in Nova. If a StorageError occurs when attempting to connect a volume using the Xen API, the connection parameters will be logged. These parameters may include credentials that are not masked. An attacker with read access to Nova logs could use these credentials with the Xen API directly. Only Nova deployments using the Xen backend are affected by this flaw. References: https://launchpad.net/bugs/1516765 @maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.