CVE-2013-6480: Infoleak
Libcloud 0.12.3 through 0.13.2 does not set the scrubdata parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.
Other sources
Libcloud 0.12.3 through 0.13.2 does not set the scrubdata parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/apache-libcloudto a version that resolves this vulnerability.Fixed in 0.13.3
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6480?
CVE-2013-6480 is classified as a medium severity vulnerability.
How do I fix CVE-2013-6480?
To fix CVE-2013-6480, update Apache Libcloud to version 0.13.3 or later.
What versions are affected by CVE-2013-6480?
Apache Libcloud versions 0.12.3 to 0.13.2 are affected by CVE-2013-6480.
What type of vulnerability is CVE-2013-6480?
CVE-2013-6480 is a local information disclosure vulnerability in Apache Libcloud.
Who is affected by CVE-2013-6480?
Local users who can create new virtual machines via the DigitalOcean API are affected by CVE-2013-6480.