Information Leakage in OpenStack Nova
Summary
CVE-2019-14433: An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. Affects nova across 2 version ranges.
< 2:19.0.2-1
< 6212da3f57e3405e4a034e35e6cd6f17e555d5f2
Fixed in 2:19.0.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Nova is an open-source cloud computing platform that enables the management of virtual machines and other resources. It provides a scalable and flexible infrastructure for building and managing cloud environments. However, a vulnerability has been discovered in Nova that can lead to information leakage.
Vulnerability Detail
The vulnerability, identified as CVE-2019-14433, exists in OpenStack Nova versions before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. When an authenticated user makes an API request that results in a fault condition caused by an external exception, sensitive information about the underlying environment may be exposed in the response. This information can include confidential configuration data, potentially leading to unauthorized access or further exploitation.
How To Fix
Minimum fixed version
2:19.0.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade novaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by upgrading to the patched versions of OpenStack Nova.
Conclusion
The information leakage vulnerability in OpenStack Nova can have serious consequences, as it may expose sensitive configuration data. It is crucial to upgrade to the patched versions of Nova to mitigate the risk. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for nova →
FAQ
OpenStack Nova is an open-source cloud computing platform that allows the management of virtual machines and resources in a cloud environment.
The vulnerability can lead to the exposure of sensitive configuration data, potentially enabling unauthorized access or further exploitation.
To fix this vulnerability, upgrade to OpenStack Nova version 17.0.12, 18.2.2, or 19.0.2, depending on the specific version in use.
No, there is no known workaround for this vulnerability. Applying the provided fix is necessary.
For more information, you can refer to the official CVE-2019-14433 advisory or contact the OpenStack Nova support team.
Related vulnerabilities
Recent vulnerabilities recorded for nova.
