NVD Vulnerability Detail

CVE-2015-8749

Summary	The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.
Publication Date	Jan. 16, 2016, 4:59 a.m.
Registration Date	Jan. 26, 2021, 2:58 p.m.
Last Update	Nov. 21, 2024, 11:39 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2016/01/07/8	Mailing List Third Party Advisory
2	http://www.openwall.com/lists/oss-security/2016/01/07/8	Mailing List Third Party Advisory
3	http://www.openwall.com/lists/oss-security/2016/01/07/9	Mailing List Third Party Advisory
4	http://www.openwall.com/lists/oss-security/2016/01/07/9	Mailing List Third Party Advisory
5	http://www.securityfocus.com/bid/80189	Third Party Advisory VDB Entry
6	http://www.securityfocus.com/bid/80189	Third Party Advisory VDB Entry
7	https://bugs.launchpad.net/nova/+bug/1516765	Third Party Advisory
8	https://bugs.launchpad.net/nova/+bug/1516765	Third Party Advisory
9	https://security.openstack.org/ossa/OSSA-2016-002.html	Patch Vendor Advisory
10	https://security.openstack.org/ossa/OSSA-2016-002.html	Patch Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-200	情報漏えい	https://cwe.mitre.org/data/definitions/200.html

JVN Vulnerability Information

OpenStack Compute の volume_utils._parse_volume_info 関数における重要なパスワード情報を取得される脆弱性

Title	OpenStack Compute の volume_utils._parse_volume_info 関数における重要なパスワード情報を取得される脆弱性
Summary	OpenStack Compute (Nova) の volume_utils._parse_volume_info 関数は、Xen のバックエンドを使用する場合、StorageError メッセージに connection_info ディクショナリを含めるため、重要なパスワード情報を取得される脆弱性が存在します。
Possible impacts	攻撃者により、ログファイルを読まれることで、またはその他の不特定の要因を介して、重要なパスワード情報を取得される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Dec. 3, 2015, midnight
Registration Date	Jan. 26, 2016, 1:53 p.m.
Last Update	Jan. 26, 2016, 1:53 p.m.

Affected System

OpenStack

OpenStack Compute 12.0.1 (liberty) 未満の 12.0.x

OpenStack Compute 2015.1.3 (kilo) 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-8749	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8749
2	CVE-2015-8749	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8749
National Vulnerability Database (NVD)
3	CVE-2015-8749	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8749
4	CVE-2015-8749	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-8749

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html
2	CWE-200	https://jvndb.jvn.jp/ja/cwe/CWE-200.html

ベンダー情報

No	Name	URL
Launchpad
1	Bug #1516765	https://bugs.launchpad.net/nova/+bug/1516765
2	Bug #1516765	https://bugs.launchpad.net/nova/+bug/1516765
OpenStack Security Advisories
3	OSSA-2016-002: Xen connection password leak in logs via StorageError	https://security.openstack.org/ossa/OSSA-2016-002.html
4	OSSA-2016-002: Xen connection password leak in logs via StorageError	https://security.openstack.org/ossa/OSSA-2016-002.html

Change Log

No	Changed Details	Date of change
0	[2016年01月26日] 掲載	Feb. 17, 2018, 10:37 a.m.