CVE-2015-8749

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-01-15 · updated 2026-06-17
Weakness: CWE-200

Description

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.

Affected products

OpenStack Nova: from 12.0.0 before 12.0.1; from 2015.1.0 before 2015.1.3 — fixed in 12.0.1, 2015.1.3

How to fix

Upgrade to a fixed version: OpenStack Nova 12.0.1, 2015.1.3. Check the vendor advisory for mitigations.

References

http://www.openwall.com/lists/oss-security/2016/01/07/8
http://www.openwall.com/lists/oss-security/2016/01/07/9
http://www.securityfocus.com/bid/80189
https://bugs.launchpad.net/nova/+bug/1516765
https://security.openstack.org/ossa/OSSA-2016-002.html
http://www.openwall.com/lists/oss-security/2016/01/07/8
http://www.openwall.com/lists/oss-security/2016/01/07/9
http://www.securityfocus.com/bid/80189
https://bugs.launchpad.net/nova/+bug/1516765
https://security.openstack.org/ossa/OSSA-2016-002.html

Get alerted when CVE-2015-8749 or the next vulnerability affects your stack