CVE-2014-7230
Fixed in a distro release EPSS <1%
The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a ProcessExecutionError by reading the log.
Products: openstack cinder, openstack nova, openstack trove, redhat openstack, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | cinder | 2014.1.3-4 |
| Debian 12 | nova | 2014.1.3-5 |
| Debian 12 | openstack-trove | 2014.1.3-1 |
| Debian 13 | cinder | 2014.1.3-4 |
| Debian 13 | nova | 2014.1.3-5 |
| Debian 13 | openstack-trove | 2014.1.3-1 |
| Debian 14 | cinder | 2014.1.3-4 |
| Debian 14 | nova | 2014.1.3-5 |
| Debian 14 | openstack-trove | 2014.1.3-1 |
| Red Hat openstack 5 | openstack-cinder | 0:2014.1.3-1.el7ost |
| Red Hat openstack 5 | openstack-cinder | 0:2014.1.3-1.el6ost |
| Red Hat openstack 5 | openstack-cinder-doc | 0:2014.1.3-1.el7ost |
| Red Hat openstack 5 | openstack-cinder-doc | 0:2014.1.3-1.el6ost |
| Red Hat openstack 5 | openstack-nova | 0:2014.1.3-4.el7ost |
| Red Hat openstack 5 | openstack-nova | 0:2014.1.3-4.el6ost |
| Red Hat openstack 5 | openstack-nova-api | 0:2014.1.3-4.el6ost |
| Red Hat openstack 5 | openstack-nova-api | 0:2014.1.3-4.el7ost |
| Red Hat openstack 5 | openstack-nova-cells | 0:2014.1.3-4.el7ost |
| Red Hat openstack 5 | openstack-nova-cells | 0:2014.1.3-4.el6ost |
| Red Hat openstack 5 | openstack-nova-cert | 0:2014.1.3-4.el6ost |
| Red Hat openstack 5 | openstack-nova-cert | 0:2014.1.3-4.el7ost |
| Red Hat openstack 5 | openstack-nova-common | 0:2014.1.3-4.el6ost |
| Red Hat openstack 5 | openstack-nova-common | 0:2014.1.3-4.el7ost |
| Red Hat openstack 5 | openstack-nova-compute | 0:2014.1.3-4.el7ost |
| Red Hat openstack 5 | openstack-nova-compute | 0:2014.1.3-4.el6ost |
| Red Hat openstack 5 | openstack-nova-conductor | 0:2014.1.3-4.el6ost |
| Red Hat openstack 5 | openstack-nova-conductor | 0:2014.1.3-4.el7ost |
| Red Hat openstack 5 | openstack-nova-console | 0:2014.1.3-4.el6ost |
| Red Hat openstack 5 | openstack-nova-console | 0:2014.1.3-4.el7ost |
| Red Hat openstack 5 | openstack-nova-doc | 0:2014.1.3-4.el7ost |
| Red Hat openstack 5 | openstack-nova-doc | 0:2014.1.3-4.el6ost |
| Red Hat openstack 5 | openstack-nova-network | 0:2014.1.3-4.el7ost |
| Red Hat openstack 5 | openstack-nova-network | 0:2014.1.3-4.el6ost |
| Red Hat openstack 5 | openstack-nova-novncproxy | 0:2014.1.3-4.el7ost |
| Red Hat openstack 5 | openstack-nova-novncproxy | 0:2014.1.3-4.el6ost |
| Red Hat openstack 5 | openstack-nova-objectstore | 0:2014.1.3-4.el6ost |
| Red Hat openstack 5 | openstack-nova-objectstore | 0:2014.1.3-4.el7ost |
| Red Hat openstack 5 | openstack-nova-scheduler | 0:2014.1.3-4.el7ost |
| Red Hat openstack 5 | openstack-nova-scheduler | 0:2014.1.3-4.el6ost |
| Red Hat openstack 5 | openstack-trove | 0:2014.1.3-1.el7ost |
| Red Hat openstack 5 | openstack-trove-api | 0:2014.1.3-1.el7ost |
| Red Hat openstack 5 | openstack-trove-common | 0:2014.1.3-1.el7ost |
| Red Hat openstack 5 | openstack-trove-conductor | 0:2014.1.3-1.el7ost |
| Red Hat openstack 5 | openstack-trove-guestagent | 0:2014.1.3-1.el7ost |
| Red Hat openstack 5 | openstack-trove-taskmanager | 0:2014.1.3-1.el7ost |
| Red Hat openstack 5 | python-cinder | 0:2014.1.3-1.el7ost |
| Red Hat openstack 5 | python-cinder | 0:2014.1.3-1.el6ost |
| Red Hat openstack 5 | python-nova | 0:2014.1.3-4.el6ost |
| Red Hat openstack 5 | python-nova | 0:2014.1.3-4.el7ost |
| Red Hat openstack 5 | python-trove | 0:2014.1.3-1.el7ost |
| Ubuntu 14.04 LTS | cinder | 1:2014.1.3-0ubuntu1 |
| Ubuntu 14.04 LTS | cinder | 1:2014.1.3-0ubuntu1.1 |
| Ubuntu 14.04 LTS | nova | 1:2014.1.3-0ubuntu1 |
| Ubuntu 14.04 LTS | nova | 1:2014.1.3-0ubuntu1.1 |
| Ubuntu 16.04 LTS | trove | no fix |
| Ubuntu 18.04 LTS | trove | no fix |