CVE-2015-9543

low-risk
Published 2020-02-19

An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is related to NovaProxyRequestHandlerBase.new_websocket_client in console/websocketproxy.py.

Do I need to act?

-
0.08% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
3
CVSS 3.3/10 Low
LOCAL / LOW complexity

Affected Products (1)

Nova

Affected Vendors

Openstack

References (8)

Mailing List http://www.openwall.com/lists/oss-security/2020/02/19/2
Issue Tracking https://launchpad.net/bugs/1492140
Third Party Advisory https://review.opendev.org/220622
Patch https://security.openstack.org/ossa/OSSA-2020-001.html
Mailing List http://www.openwall.com/lists/oss-security/2020/02/19/2
Issue Tracking https://launchpad.net/bugs/1492140
Third Party Advisory https://review.opendev.org/220622
Patch https://security.openstack.org/ossa/OSSA-2020-001.html
18
/ 100
low-risk
Severity 13/34 · Low
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal