CVE-2014-7230 The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a Proc...
LowCVSS 2.1
EPSS 0.49%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a ProcessExecutionError by reading the log.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/cinder(Debian:12) | < 2014.1.3-4 | 2014.1.3-4 |
| debian/cinder(Debian:13) | < 2014.1.3-4 | 2014.1.3-4 |
| debian/cinder(Debian:14) | < 2014.1.3-4 | 2014.1.3-4 |
| debian/nova(Debian:12) | < 2014.1.3-5 | 2014.1.3-5 |
| debian/nova(Debian:13) | < 2014.1.3-5 | 2014.1.3-5 |
| debian/nova(Debian:14) | < 2014.1.3-5 | 2014.1.3-5 |
| debian/openstack-trove(Debian:12) | < 2014.1.3-1 | 2014.1.3-1 |
| debian/openstack-trove(Debian:13) | < 2014.1.3-1 | 2014.1.3-1 |
| debian/openstack-trove(Debian:14) | < 2014.1.3-1 | 2014.1.3-1 |
| OpenStack cinder | >= 2013.2, < 2013.2.4 | 2013.2.4 |
| OpenStack cinder | >= 2014.1, < 2014.1.3 | 2014.1.3 |
| OpenStack Nova | >= 2013.2, < 2013.2.4 | 2013.2.4 |
| OpenStack Nova | >= 2014.1, < 2014.1.3 | 2014.1.3 |
| OpenStack trove | >= 2013.2, < 2013.2.4 | 2013.2.4 |
| OpenStack trove | >= 2014.1, < 2014.1.3 | 2014.1.3 |
| redhat openstack | = 5.0 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
References
- Debian Security Tracker CVE-2014-7230 vendor-advisory
- RHSA-2014:1939 third-party-advisory vendor-advisory
- [oss-security] 20140929 Re: CVE request for vulnerability in OpenStack Cinder, Nova and Trove mailing-list third-party-advisory
- 70185 third-party-advisory vdb-entry
- USN-2405-1 third-party-advisory vendor-advisory
- bugs.launchpad.net third-party-advisory
- openstack-cinder-cve20147230-info-disc(96725) third-party-advisory vdb-entry
- bugs.debian.org issue-tracking
- bugs.debian.org issue-tracking