CVE-2019-14433: Infoleak
A vulnerability was found in Nova Compute resource fault handling. If an API request from an authenticateduser ends in a fault condition due to an external exception, details of the underlying environment may be leaked in the response and could include sensitive configuration or other data.
Other sources
An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environment may be leaked in the response, and could include sensitive configuration or other data.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/novato a version that resolves this vulnerability.Fixed in 19.0.2 - Upgrade
Upgrade
pip/novato a version that resolves this vulnerability.Fixed in 18.2.2 - Upgrade
Upgrade
pip/novato a version that resolves this vulnerability.Fixed in 17.0.12 - Upgrade
Upgrade
debian/novato a version that resolves this vulnerability.Fixed in 2:22.0.1-2+deb11u1Fixed in 2:22.4.0-1~deb11u7Fixed in 2:26.2.2-1~deb12u3Fixed in 2:26.2.2-1~deb12u4Fixed in 2:31.0.0-6+deb13u1Fixed in 2:31.0.0-6+deb13u2Fixed in 2:32.1.0-7 - Upgrade
Upgrade
OpenStack Nova Computeto a version that resolves this vulnerability.Fixed in 17.0.12 - Upgrade
Upgrade
OpenStack Nova Computeto a version that resolves this vulnerability.Fixed in 18.2.2 - Upgrade
Upgrade
OpenStack Nova Computeto a version that resolves this vulnerability.Fixed in 19.0.2
Event History
Frequently Asked Questions
What is CVE-2019-14433?
CVE-2019-14433 is a vulnerability in OpenStack Nova before version 17.0.12, 18.x before version 18.2.2, and 19.x before version 19.0.2.
What is the severity of CVE-2019-14433?
The severity of CVE-2019-14433 is medium with a severity value of 6.5.
How can I fix CVE-2019-14433?
To fix CVE-2019-14433, you should update to OpenStack Nova version 17.0.12, 18.2.2, or 19.0.2 depending on your current version.
Where can I find more information about CVE-2019-14433?
You can find more information about CVE-2019-14433 in the references section: [Link 1](http://www.openwall.com/lists/oss-security/2019/08/06/6), [Link 2](https://access.redhat.com/errata/RHSA-2019:2622), [Link 3](https://access.redhat.com/errata/RHSA-2019:2631).
What is the CWE of CVE-2019-14433?
The CWE (Common Weakness Enumeration) of CVE-2019-14433 is CWE-209.