CVE-2014-4615: Infoleak
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain XAUTHTOKEN values by reading the message queue (v2/meters/http.request).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4615?
CVE-2014-4615 is classified as a high severity vulnerability due to the risk of unauthorized access to X_AUTH_TOKEN values.
How do I fix CVE-2014-4615?
To mitigate CVE-2014-4615, upgrade OpenStack PyCADF to version 0.6.0 or later, OpenStack Telemetry to version 2013.2.4 or later, Neutron to version 2014.1.2 or later, and ensure that you are running the latest builds of relevant components.
Who is affected by CVE-2014-4615?
CVE-2014-4615 affects users of OpenStack PyCADF versions 0.5.0 and earlier, as well as certain versions of Telemetry (Ceilometer), Neutron, and Oslo middleware.
What is the impact of CVE-2014-4615?
The impact of CVE-2014-4615 includes the potential for remote authenticated users to intercept and gain access to sensitive X_AUTH_TOKEN values.
When was CVE-2014-4615 disclosed?
CVE-2014-4615 was disclosed in 2014, primarily affecting OpenStack components prior to specified patched versions.