What’s Vulnerable › Vulnerabilities

CVE-2014-7230

• Severity: low (CVSS 2.1 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-10-08 · updated 2026-06-17
• Weakness: CWE-200

Description

The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a ProcessExecutionError by reading the log.

Affected products

• Canonical Ubuntu Linux: 14.04
• OpenStack Cinder: from 2013.2 before 2013.2.4; from 2014.1 before 2014.1.3 — fixed in 2013.2.4, 2014.1.3
• OpenStack Nova: from 2013.2 before 2013.2.4; from 2014.1 before 2014.1.3 — fixed in 2013.2.4, 2014.1.3
• OpenStack Trove: from 2013.2 before 2013.2.4; from 2014.1 before 2014.1.3 — fixed in 2013.2.4, 2014.1.3
• OpenStack: 5.0

How to fix

Upgrade to a fixed version: OpenStack Cinder 2013.2.4, 2014.1.3; OpenStack Nova 2013.2.4, 2014.1.3; OpenStack Trove 2013.2.4, 2014.1.3. Check the vendor advisory for mitigations.

References

• http://rhn.redhat.com/errata/RHSA-2014-1939.html
• http://seclists.org/oss-sec/2014/q3/853
• http://www.securityfocus.com/bid/70185
• http://www.ubuntu.com/usn/USN-2405-1
• https://bugs.launchpad.net/oslo-incubator/+bug/1343604
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96725
• http://rhn.redhat.com/errata/RHSA-2014-1939.html
• http://seclists.org/oss-sec/2014/q3/853
• http://www.securityfocus.com/bid/70185
• http://www.ubuntu.com/usn/USN-2405-1
• https://bugs.launchpad.net/oslo-incubator/+bug/1343604
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96725

Get alerted when CVE-2014-7230 or the next vulnerability affects your stack