GitHub Advisoryadvisory · PyPI

GHSA-22jm-4hxw-35jf OpenStack Nova can leak consoleauth token into log files

LOW Published 2022-05-24 Modified 2024-05-09 Official page ↗
Aliases
CVE-2015-9543
Ecosystem
PyPI
Packages
Nova
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-200
Reviewed
2024-05-09

Affected packages

• PyPI Nova: < 18.2.4 → fixed in 18.2.4 • PyPI Nova: >= 19.0.0, < 19.1.0 → fixed in 19.1.0 • PyPI Nova: >= 20.0.0, < 20.1.0 → fixed in 20.1.0

Description

An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is related to `NovaProxyRequestHandlerBase.new_websocket_client` in `console/websocketproxy.py`.

Related

Alias · CVE (1)

  • CVE-2015-9543 An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References