CVE-2015-7514: Infoleak
First published: Thu Nov 26 2015(Updated: )
A flaw was reported in Ironic: Brad Morgan from Rackspace reported a vulnerability in Ironic. To prevent user data leak, Ironic is expected to "clean" a server after use, however that is transparently not happening. Previous tenant's data may be left behind on the disk and may be available to new users. All Ironic setups are affected. This flaw is reported to affect versions >= 4.2.0 and <= 4.2.1. Acknowledgements: Red Hat would like to thank the OpenStack project for reporting this issue. Upstream acknowledges Brad Morgan from Rackspace as the original reporter.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenStack Ironic | =4.2.0 | |
| OpenStack Ironic | =4.2.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1099283
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1099283&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1099284
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1099284&action=edit
- http://seclists.org/oss-sec/2015/q4/426
- https://bugzilla.redhat.com/show_bug.cgi?id=1285809
- http://www.openwall.com/lists/oss-security/2015/12/03/4
- https://review.openstack.org/#/c/252993
- https://review.openstack.org/#/c/253001
Frequently Asked Questions
What is the severity of CVE-2015-7514?
CVE-2015-7514 is considered a medium severity vulnerability as it can lead to data leakage between tenants.
How do I fix CVE-2015-7514?
To fix CVE-2015-7514, upgrade OpenStack Ironic to version 4.2.2 or later to ensure proper data cleaning between user sessions.
What does CVE-2015-7514 affect?
CVE-2015-7514 affects OpenStack Ironic versions 4.2.0 and 4.2.1.
What is the impact of CVE-2015-7514?
The impact of CVE-2015-7514 is that residual data from previous tenants may remain on the disk, potentially exposing sensitive information.
Who reported CVE-2015-7514?
CVE-2015-7514 was reported by Brad Morgan from Rackspace.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/references
- agent/author
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/event
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-7514
- agent/trending
- agent/tags
- agent/source
- vendor/openstack
- canonical/openstack ironic
- version/openstack ironic/4.2.0
- version/openstack ironic/4.2.1