Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 23 Mar 2017 14:42:53 +0000
From: Jeremy Stanley <>
Subject: [OSSA-2017-002] Nova logs sensitive context from notification
 exceptions (CVE-2017-7214)

OSSA-2017-002: Nova logs sensitive context from notification exceptions

:Date: March 23, 2017
:CVE: CVE-2017-7214

- Nova: >=13.0.0 <=13.1.3, >=14.0.0 <=14.0.4, >=15.0.0 <=15.0.1

Matt Riedemann with Huawei reported a vulnerability in Nova. Legacy
notification exception contexts appearing in ERROR level logs may
include sensitive information such as account passwords and
authorization tokens. All Nova setups are affected.

- (Mitaka)
- (Newton)
- (Ocata)
- (Pike)

- Matt Riedemann from Huawei (CVE-2017-7214)


Jeremy Stanley
OpenStack Vulnerability Management Team

Download attachment "signature.asc" of type "application/pgp-signature" (950 bytes)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ