CVE-2014-7230
CVE-2014-7230
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a ProcessExecutionError by reading the log.
EPSS 0.5% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
cinder Debian:12
- Affected ranges
- ECOSYSTEM: < 2014.1.3-4
Update to 2014.1.3-4
cinder Debian:13
- Affected ranges
- ECOSYSTEM: < 2014.1.3-4
Update to 2014.1.3-4
cinder Debian:14
- Affected ranges
- ECOSYSTEM: < 2014.1.3-4
Update to 2014.1.3-4
nova Debian:12
- Affected ranges
- ECOSYSTEM: < 2014.1.3-5
Update to 2014.1.3-5
nova Debian:13
- Affected ranges
- ECOSYSTEM: < 2014.1.3-5
Update to 2014.1.3-5
nova Debian:14
- Affected ranges
- ECOSYSTEM: < 2014.1.3-5
Update to 2014.1.3-5
openstack-trove Debian:12
- Affected ranges
- ECOSYSTEM: < 2014.1.3-1
Update to 2014.1.3-1
openstack-trove Debian:13
- Affected ranges
- ECOSYSTEM: < 2014.1.3-1
Update to 2014.1.3-1
openstack-trove Debian:14
- Affected ranges
- ECOSYSTEM: < 2014.1.3-1
Update to 2014.1.3-1
cinder Ubuntu:14.04:LTS
- Versions
- 1:2013.2~rc3-0ubuntu1
- 1:2013.2-0ubuntu1
- 1:2014.1~b1-0ubuntu1
- 1:2014.1~b1-0ubuntu2
- 1:2014.1~b2-0ubuntu1
- 1:2014.1~b3-0ubuntu2
- 1:2014.1~b3-0ubuntu3
- 1:2014.1~rc1-0ubuntu1
- 1:2014.1~rc2-0ubuntu1
- 1:2014.1~rc3-0ubuntu1
- 1:2014.1-0ubuntu1
- 1:2014.1-0ubuntu1.1
- 1:2014.1.1-0ubuntu2
- 1:2014.1.2-0ubuntu1
- Affected ranges
- ECOSYSTEM: < 1:2014.1.3-0ubuntu1
Update to 1:2014.1.3-0ubuntu1
nova Ubuntu:14.04:LTS
- Versions
- 1:2013.2~rc2-0ubuntu1
- 1:2013.2-0ubuntu1
- 1:2014.1~b1-0ubuntu1
- 1:2014.1~b1-0ubuntu2
- 1:2014.1~b2-0ubuntu3
- 1:2014.1~b2-0ubuntu4
- 1:2014.1~b3-0ubuntu1
- 1:2014.1~b3-0ubuntu2
- 1:2014.1~rc1-0ubuntu1
- 1:2014.1~rc2-0ubuntu1
- 1:2014.1-0ubuntu1
- 1:2014.1-0ubuntu1.2
- 1:2014.1.1-0ubuntu1
- 1:2014.1.1-0ubuntu2
- 1:2014.1.2-0ubuntu1
- 1:2014.1.2-0ubuntu1.1
- Affected ranges
- ECOSYSTEM: < 1:2014.1.3-0ubuntu1
Update to 1:2014.1.3-0ubuntu1
trove Ubuntu:16.04:LTS
- Versions
- 2.1.0-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
trove Ubuntu:18.04:LTS
- Versions
- 2.1.0-2
- 2.1.0-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- http://seclists.org/oss-sec/2014/q3/853
- https://exchange.xforce.ibmcloud.com/vulnerabilities/96725
- http://www.securityfocus.com/bid/70185
- https://bugs.launchpad.net/oslo-incubator/+bug/1343604
- http://rhn.redhat.com/errata/RHSA-2014-1939.html
- http://www.ubuntu.com/usn/USN-2405-1
- https://nvd.nist.gov/vuln/detail/CVE-2014-7230