Description
The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a ProcessExecutionError by reading the log.
References (6)
Core 6
Core References
Third Party Advisory x_refsource_confirm
https://bugs.launchpad.net/oslo-incubator/+bug/1343604
Third Party Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-1939.html
Third Party Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2405-1
Mailing List, Third Party Advisory mailing-list
x_refsource_mlist
http://seclists.org/oss-sec/2014/q3/853
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/96725
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/70185
Scores
EPSS
0.0012
EPSS Percentile
30.8%
Details
CWE
CWE-200
Status
published
Products (5)
canonical/ubuntu_linux
14.04
openstack/cinder
2013.2 - 2013.2.4
openstack/nova
2013.2 - 2013.2.4
openstack/trove
2013.2 - 2013.2.4
redhat/openstack
5.0
Published
Oct 08, 2014
Tracked Since
Feb 18, 2026