CVE-2015-8749

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.openwall.com/lists/oss-security/2016/01/07/8Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/01/07/9Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/80189Third Party Advisory, VDB Entry
https://bugs.launchpad.net/nova/+bug/1516765Third Party Advisory
https://security.openstack.org/ossa/OSSA-2016-002.htmlPatch, Vendor Advisory
http://www.openwall.com/lists/oss-security/2016/01/07/8Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/01/07/9Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/80189Third Party Advisory, VDB Entry
https://bugs.launchpad.net/nova/+bug/1516765Third Party Advisory
https://security.openstack.org/ossa/OSSA-2016-002.htmlPatch, Vendor Advisory

Timeline

Published: Jan 15, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-87506.5libdwarf 20151114 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a debug_abbrev s CVE-2015-87518.8Integer overflow in the jas_matrix_create function in JasPer allows context-dependent attackers to have unspecified impact via a crafted JPE CVE-2015-87539.1SAP Afaria 7.0.6001.5 allows remote attackers to bypass authorization checks and wipe or lock mobile devices via a crafted request, related CVE-2015-87547.5The Mollom module 6.x-2.7 before 6.x-2.15 for Drupal allows remote attackers to bypass intended access restrictions and modify the mollom bl CVE-2015-87555.4Multiple cross-site scripting (XSS) vulnerabilities in unspecified backend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allo CVE-2015-87565.4Cross-site scripting (XSS) vulnerability in the search result view in the Indexed Search (indexed_search) component in TYPO3 6.2.x before 6.CVE-2015-87576.1Cross-site scripting (XSS) vulnerability in the Extension Manager in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote attackers CVE-2015-87585.4Multiple cross-site scripting (XSS) vulnerabilities in unspecified frontend components in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 all CVE-2015-87595.4Cross-site scripting (XSS) vulnerability in the typoLink function in TYPO3 6.2.x before 6.2.16 and 7.x before 7.6.1 allows remote authentica CVE-2015-87606.1The Flvplayer component in TYPO3 6.2.x before 6.2.16 allows remote attackers to embed Flash videos from external domains via unspecified vec CVE-2015-87619.0The Values module 7.x-1.x before 7.x-1.2 for Drupal does not properly check permissions, which allows remote administrators with the "Import CVE-2015-87625.9The EAP-PWD module in FreeRADIUS 3.0 through 3.0.8 allows remote attackers to cause a denial of service (NULL pointer dereference and server