CVE-2013-6480 Libcloud does not properly scrub data when destroying a DigitalOcean node
LowCVSS 2.1
EPSS 2.1%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi apache-libcloud(PyPI) | >= 0.12.3, < 0.13.3 | 0.13.3 |
| pypi apache-libcloud(PyPI) | = 0.12.3 | No fix listed |
| pypi apache-libcloud(PyPI) | = 0.12.4 | No fix listed |
| pypi apache-libcloud(PyPI) | = 0.13.0 | No fix listed |
| pypi apache-libcloud(PyPI) | = 0.13.1 | No fix listed |
| pypi apache-libcloud(PyPI) | = 0.13.2 | No fix listed |
| pypi apache-libcloud(PyPI) | >= 0.12.3, <= 0.13.2 | No fix listed |
| apache libcloud | = 0.12.3 | No fix listed |
| apache libcloud | = 0.12.4 | No fix listed |
| apache libcloud | = 0.13.0 | No fix listed |
| apache libcloud | = 0.13.1 | No fix listed |
| apache libcloud | = 0.13.2 | No fix listed |
References
- Debian Security Tracker CVE-2013-6480 vendor-advisory
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com issue-tracking
- github.com patch
- github.com product
- github.com
- github.com
- issues.apache.org
- web.archive.org
- web.archive.org
- web.archive.org
- libcloud.apache.org vendor-advisory
- openSUSE-SU-2014:0198 vendor-advisory
- digitalocean.com technical-description
- 64617 vdb-entry
- 20140101 [CVE-2013-6480] Libcloud doesn't send scrub_data query parameter when destroying a DigitalOcean node mailing-list
- github.com vendor-advisory