Every CVE Search/ Get API key

CVE-2015-8749

OpenStack Nova Potential Xen connection password leak via StorageError

5.9 MediumFix available

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

2.24%Up 1.2 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.9

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.

Record
CVE-2015-8749
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.

Record
CVE-2015-8749
Updated
2026-11-02
EUVDEUVD-2022-3483 No score

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.

Record
EUVD-2022-3483
Updated
2026-11-03
GitHub AdvisoriesGHSA-c36r-g737-9qp8 5.9

OpenStack Nova Potential Xen connection password leak via StorageError

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.

Record
GHSA-c36r-g737-9qp8
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSV 5.9

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.

Record
CVE-2015-8749
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2015-8749 5.9

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.

Record
DEBIAN-CVE-2015-8749
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-c36r-g737-9qp8 5.9

OpenStack Nova Potential Xen connection password leak via StorageError

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.

Record
GHSA-c36r-g737-9qp8
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVPYSEC-2026-870 5.9

OpenStack Nova Potential Xen connection password leak via StorageError

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.

Record
PYSEC-2026-870
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2015-8749 5.9

The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.

Record
UBUNTU-CVE-2015-8749
CVSS 3.0
5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUSN-3449-1 No score

nova vulnerabilities

George Shuklin discovered that OpenStack Nova incorrectly handled the migration process. A remote authenticated user could use this issue to consume resources, resulting in a denial of service. (CVE-2015-3241)

George Shuklin and Tushar Patil discovered that OpenStack Nova incorrectly handled deleting instances. A remote authenticated user could use this issue to consume disk resources, resulting in a denial of service. (CVE-2015-3280)

It was discovered that OpenStack Nova incorrectly limited qemu-img calls. A remote authenticated user could use this issue to consume resources, resulting in a denial of service. (CVE-2015-5162)

Matthew Booth discovered that OpenStack Nova incorrectly handled snapshots. A remote authenticated user could use this issue to read arbitrary files. (CVE-2015-7548)

Sreekumar S. and Suntao discovered that OpenStack Nova incorrectly applied security group changes. A remote attacker could possibly use this issue to bypass intended restriction changes by leveraging an instance that was running when the change was made. (CVE-2015-7713)

Matt Riedemann discovered that OpenStack Nova incorrectly handled logging. A local attacker could possibly use this issue to obtain sensitive information from log files. (CVE-2015-8749)

Matthew Booth discovered that OpenStack Nova incorrectly handled certain qcow2 headers. A remote authenticated user could possibly use this issue to read arbitrary files. (CVE-2016-2140)

Record
USN-3449-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
nova
PyPI
 12.0.0 up to 12.0.1
12.0.1
nova
Debian:12
 before 2:13.0.0~rc3-1
2:13.0.0~rc3-1
nova
Debian:13
 before 2:13.0.0~rc3-1
2:13.0.0~rc3-1
nova
Debian:14
 before 2:13.0.0~rc3-1
2:13.0.0~rc3-1
nova
Ubuntu:14.04:LTS
 before 1:2014.1.5-0ubuntu1.7, plus listed versions
1:2013.2~rc2-0ubuntu11:2013.2-0ubuntu11:2014.1~b1-0ubuntu11:2014.1~b1-0ubuntu21:2014.1~b2-0ubuntu3
Show 23 moreShow less
1:2014.1~b2-0ubuntu41:2014.1~b3-0ubuntu11:2014.1~b3-0ubuntu21:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1-0ubuntu1.21:2014.1.1-0ubuntu11:2014.1.1-0ubuntu21:2014.1.2-0ubuntu11:2014.1.2-0ubuntu1.11:2014.1.3-0ubuntu11:2014.1.3-0ubuntu1.11:2014.1.3-0ubuntu21:2014.1.4-0ubuntu21:2014.1.4-0ubuntu2.11:2014.1.5-0ubuntu11:2014.1.5-0ubuntu1.11:2014.1.5-0ubuntu1.21:2014.1.5-0ubuntu1.31:2014.1.5-0ubuntu1.41:2014.1.5-0ubuntu1.51:2014.1.5-0ubuntu1.6
1:2014.1.5-0ubuntu1.7

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-8749 is a medium vulnerability (CVSS 5.9) in Openstack Nova, published January 15, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.24%, the 82nd percentile. Fixed in nova 12.0.1.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open