ALT-PU-2016-3275-1

Обновление пакета openstack-nova в ветке sisyphus

Версия12.0.2-alt1

Задание#162066

Опубликовано2016-03-28

Макс. серьёзностьMEDIUM

Серьёзность:

Закрытые проблемы (3)

LOW3.5

OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty), when using libvirt to spawn instances and use_cow_images is set to false, allow remote authenticated users to read arbitrary files by overwriting an instance disk with a crafted image and requesting a snapshot.

Опубликовано: 2016-01-12Изменено: 2025-04-12

CVSS 2.0НИЗКАЯ 2.1

CVSS:2.0/AV:N/AC:H/Au:S/C:P/I:N/A:N

CVSS 3.xНИЗКАЯ 3.5

CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N

Ссылки

MEDIUM5.9

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.

Опубликовано: 2016-01-15Изменено: 2025-04-12

CVSS 2.0СРЕДНЯЯ 4.3

CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS 3.xСРЕДНЯЯ 5.9

CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Ссылки

GHSA-c36r-g737-9qp8

MEDIUM5.9

OpenStack Nova Potential Xen connection password leak via StorageError

Опубликовано: 2022-05-14Изменено: 2024-05-15

CVSS 3.xСРЕДНЯЯ 5.9

CVSS:3.x/CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Ссылки