CVE-2014-7230

BASSO 2.1CVE-2014-7230 · Published 08/10/2014 · updated 17/06/2026

Package	Affected versions	Patched versions
cinder openstack	`≥ 2013.2, < 2013.2.4≥ 2014.1, < 2014.1.3`	`2013.2.42014.1.3`
nova openstack	`≥ 2013.2, < 2013.2.4≥ 2014.1, < 2014.1.3`	`2013.2.42014.1.3`
trove openstack	`≥ 2013.2, < 2013.2.4≥ 2014.1, < 2014.1.3`	`2013.2.42014.1.3`
openstack redhat	`= 5.0`	No fix yet

Description

The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a ProcessExecutionError by reading the log.

References

rhn.redhat.com/errata/RHSA-2014-1939.html · Third Party Advisory
seclists.org/oss-sec/2014/q3/853 · Mailing List
securityfocus.com/bid/70185 · Third Party Advisory
ubuntu.com/usn/USN-2405-1 · Third Party Advisory
bugs.launchpad.net/oslo-incubator/+bug/1343604 · Third Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/96725 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free