NVD

Id
28811  
Name
CVE-2015-8749  
Description
The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2016-01-15  
Modified Date
2016-11-28  
Seq
2015-8749  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
151706 28811 CVE-2015-8749 [oss-security] 20160107 CVE request for vulnerability in OpenStack Nova  View
151707 28811 CVE-2015-8749 [oss-security] 20160107 Re: CVE request for vulnerability in OpenStack Nova  View
151708 28811 CVE-2015-8749 80189  View
151709 28811 CVE-2015-8749 https://bugs.launchpad.net/nova/+bug/1516765  View
151710 28811 CVE-2015-8749 https://security.openstack.org/ossa/OSSA-2016-002.html  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
11512 JVNDB-2015-006832 OpenStack Compute の volume_utils._parse_volume_info 関数における重要なパスワード情報を取得される脆弱性 OpenStack Compute (Nova) の volume_utils._parse_volume_info 関数は、Xen のバックエンドを使用する場合、StorageError メッセージに connection_info ディクショナリを含めるため、重要なパスワード情報を取得される脆弱性が存在します。 CVE-2015-8749 85974 CVE-2015-8749 28811 4.3 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-006832.html 2015-12-03 2016-01-26 View