{"id":"CVE-2015-8749","aliases":["DEBIAN-CVE-2015-8749","EUVD-2022-3483","GHSA-c36r-g737-9qp8","PYSEC-2026-870","UBUNTU-CVE-2015-8749","USN-3449-1"],"status":"published","title":"OpenStack Nova Potential Xen connection password leak via StorageError","description":"The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0224,"percentile":0.82951,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2016-01-15T00:00:00Z","modified":"2026-09-09T07:02:00Z","fixes":[{"ecosystem":"PyPI","package":"nova","fixed_in":["12.0.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"nova","fixed_in":["2:13.0.0~rc3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"nova","fixed_in":["2:13.0.0~rc3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"nova","fixed_in":["2:13.0.0~rc3-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"nova","fixed_in":["1:2014.1.5-0ubuntu1.7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:13.0.0~rc3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:13.0.0~rc3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:13.0.0~rc3-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2014.1.5-0ubuntu1.7"}]}],"versions":["1:2013.2~rc2-0ubuntu1","1:2013.2-0ubuntu1","1:2014.1~b1-0ubuntu1","1:2014.1~b1-0ubuntu2","1:2014.1~b2-0ubuntu3","1:2014.1~b2-0ubuntu4","1:2014.1~b3-0ubuntu1","1:2014.1~b3-0ubuntu2","1:2014.1~rc1-0ubuntu1","1:2014.1~rc2-0ubuntu1","1:2014.1-0ubuntu1","1:2014.1-0ubuntu1.2","1:2014.1.1-0ubuntu1","1:2014.1.1-0ubuntu2","1:2014.1.2-0ubuntu1","1:2014.1.2-0ubuntu1.1","1:2014.1.3-0ubuntu1","1:2014.1.3-0ubuntu1.1","1:2014.1.3-0ubuntu2","1:2014.1.4-0ubuntu2","1:2014.1.4-0ubuntu2.1","1:2014.1.5-0ubuntu1","1:2014.1.5-0ubuntu1.1","1:2014.1.5-0ubuntu1.2","1:2014.1.5-0ubuntu1.3","1:2014.1.5-0ubuntu1.4","1:2014.1.5-0ubuntu1.5","1:2014.1.5-0ubuntu1.6"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2014.1.5-0ubuntu1.7"}]}],"versions":["1:2013.2~rc2-0ubuntu1","1:2013.2-0ubuntu1","1:2014.1~b1-0ubuntu1","1:2014.1~b1-0ubuntu2","1:2014.1~b2-0ubuntu3","1:2014.1~b2-0ubuntu4","1:2014.1~b3-0ubuntu1","1:2014.1~b3-0ubuntu2","1:2014.1~rc1-0ubuntu1","1:2014.1~rc2-0ubuntu1","1:2014.1-0ubuntu1","1:2014.1-0ubuntu1.2","1:2014.1.1-0ubuntu1","1:2014.1.1-0ubuntu2","1:2014.1.2-0ubuntu1","1:2014.1.2-0ubuntu1.1","1:2014.1.3-0ubuntu1","1:2014.1.3-0ubuntu1.1","1:2014.1.3-0ubuntu2","1:2014.1.4-0ubuntu2","1:2014.1.4-0ubuntu2.1","1:2014.1.5-0ubuntu1","1:2014.1.5-0ubuntu1.1","1:2014.1.5-0ubuntu1.2","1:2014.1.5-0ubuntu1.3","1:2014.1.5-0ubuntu1.4","1:2014.1.5-0ubuntu1.5","1:2014.1.5-0ubuntu1.6"],"bundled":7}],"products":[{"vendor":"openstack","product":"nova"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2016/01/07/9","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"http://www.securityfocus.com/bid/80189","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://security.openstack.org/ossa/OSSA-2016-002.html","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","web"]},{"url":"https://bugs.launchpad.net/nova/+bug/1516765","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2016/01/07/8","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8749","tags":["advisory"]},{"url":"https://github.com/openstack/nova/commit/8b289237ed6d53738c22878decf0c429301cf3d0","tags":["web"]},{"url":"https://github.com/openstack/nova/commit/b2acc9fa864b6fe10bc0c5f3786b976b472b1b27","tags":["web"]},{"url":"https://github.com/openstack/nova/commit/cf197ec2d682fb4da777df2291ca7ef101f73b77","tags":["web"]},{"url":"https://github.com/openstack/nova/commit/ef1ccdaca9512b88878155f7d8c2c77853d91252","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c36r-g737-9qp8","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-8749","tags":["advisory"]},{"url":"https://github.com/openstack/nova","tags":["package"]},{"url":"https://pypi.org/project/nova","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2015-8749","tags":["report"]},{"url":"http://lists.openstack.org/pipermail/openstack-announce/2016-January/000916.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3449-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8749","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3241","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3280","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-5162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7548","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-7713","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2140","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-8749","description":"The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.","status":"published","published":"2016-01-15T19:00:00Z","modified":"2024-08-06T08:29:21.589Z","updated_at":"2026-11-02T14:35:41.26549Z"}],"euvd":[{"id":"EUVD-2022-3483","description":"The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.","status":"published","published":"2016-01-15T19:00:00Z","modified":"2024-08-06T08:29:21Z","updated_at":"2026-11-03T01:57:25.869767Z"}],"ghsa":[{"id":"GHSA-c36r-g737-9qp8","title":" OpenStack Nova Potential Xen connection password leak via StorageError","description":"The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.","status":"published","published":"2022-05-14T01:58:45Z","modified":"2024-05-14T21:13:54Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:48.848211Z"}],"nvd":[{"id":"CVE-2015-8749","description":"The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.","status":"published","published":"2016-01-15T19:59:04.133Z","modified":"2026-06-17T00:35:09.95Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:15.746629Z"}],"osv":[{"id":"CVE-2015-8749","description":"The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.","status":"published","published":"2016-01-15T19:59:04Z","modified":"2026-07-07T11:56:40.662958581Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:01.068991Z"},{"id":"DEBIAN-CVE-2015-8749","description":"The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.","status":"published","published":"2016-01-15T19:59:04.133Z","modified":"2026-09-09T07:02:00.322659861Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:27.04239Z"},{"id":"GHSA-c36r-g737-9qp8","title":" OpenStack Nova Potential Xen connection password leak via StorageError","description":"The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.","status":"published","published":"2022-05-14T01:58:45Z","modified":"2026-07-07T11:56:40.662958581Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:44.571161Z"},{"id":"PYSEC-2026-870","title":" OpenStack Nova Potential Xen connection password leak via StorageError","description":"The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.","status":"published","published":"2026-07-06T08:03:22.625114Z","modified":"2026-07-07T11:45:47.854613127Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.117212Z"},{"id":"UBUNTU-CVE-2015-8749","description":"The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.","status":"published","published":"2016-01-15T00:00:00Z","modified":"2026-02-04T04:40:22.316514Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:11.100633Z"},{"id":"USN-3449-1","title":"nova vulnerabilities","description":"George Shuklin discovered that OpenStack Nova incorrectly handled the\nmigration process. A remote authenticated user could use this issue to\nconsume resources, resulting in a denial of service. (CVE-2015-3241)\n\nGeorge Shuklin and Tushar Patil discovered that OpenStack Nova incorrectly\nhandled deleting instances. A remote authenticated user could use this\nissue to consume disk resources, resulting in a denial of service.\n(CVE-2015-3280)\n\nIt was discovered that OpenStack Nova incorrectly limited qemu-img calls. A\nremote authenticated user could use this issue to consume resources,\nresulting in a denial of service. (CVE-2015-5162)\n\nMatthew Booth discovered that OpenStack Nova incorrectly handled snapshots.\nA remote authenticated user could use this issue to read arbitrary files.\n(CVE-2015-7548)\n\nSreekumar S. and Suntao discovered that OpenStack Nova incorrectly applied\nsecurity group changes. A remote attacker could possibly use this issue to\nbypass intended restriction changes by leveraging an instance that was\nrunning when the change was made. (CVE-2015-7713)\n\nMatt Riedemann discovered that OpenStack Nova incorrectly handled logging.\nA local attacker could possibly use this issue to obtain sensitive\ninformation from log files. (CVE-2015-8749)\n\nMatthew Booth discovered that OpenStack Nova incorrectly handled certain\nqcow2 headers. A remote authenticated user could possibly use this issue to\nread arbitrary files. (CVE-2016-2140)\n","status":"published","published":"2017-10-11T11:46:58Z","modified":"2026-02-10T04:41:13Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}