CVE-2015-9543

LOW3.3EPSS 0.08%

OpenStack Nova can leak consoleauth token into log files

Published: 5/24/2022Modified: 5/9/2024

Also known as:GHSA-22jm-4hxw-35jfDEBIAN-CVE-2015-9543

Description

An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is related to `NovaProxyRequestHandlerBase.new_websocket_client` in `console/websocketproxy.py`.

Affected packages (2)

Debian/novafrom 0, < 2:20.1.1-1
PyPI/novafrom 0, < 18.2.4

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	LOW3.3	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References (9)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2015-9543
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2015-9543
WEBhttps://github.com/openstack/nova/commit/08f1f914cc219cf526adfb08c46b8f40b4e78232
WEBhttps://github.com/openstack/nova/commit/26d4047e17eba9bc271f8868f1d0ffeec97b555e
WEBhttps://github.com/openstack/nova/commit/d8fbf04f325f593836f8d44b6bbf42b85bde94e3
WEBhttps://launchpad.net/bugs/1492140
WEBhttps://review.opendev.org/220622
WEBhttps://security.openstack.org/ossa/OSSA-2020-001.html
WEBhttp://www.openwall.com/lists/oss-security/2020/02/19/2