The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3…
Priority LOW 31CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.
Why it matters now
EPSS 0.0224 82nd percentileScored 2026-11-07
Fix Fixed nova (PyPI): 12.0.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | nova (PyPI) | 12.0.0 to before 12.0.1 | 12.0.1 | Patch available | GHSA-c36r-g737-9qp8 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- nova (PyPI) Vendor— Affected 12.0.0 to before 12.0.1 Fixed in 12.0.1 Patch available GHSA-c36r-g737-9qp8
Remediation
- Fix · GHSA-c36r-g737-9qp8 nova (PyPI) Fixed in 12.0.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 4 products
- Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)
- Red Hat Enterprise Linux OpenStack Platform 6 (Juno)
- Red Hat Enterprise Linux OpenStack Platform 7 (Kilo)
- Red Hat OpenStack Platform 8 (Liberty)
Timeline
- 2026-10-02 Threatist record created from CVE-2015-8749
- 2026-10-03 Alias added: GHSA-c36r-g737-9qp8
References
Advisory 4
Other 5
- https://github.com/openstack/nova/commit/8b289237ed6d53738c22878decf0c429301cf3d0
- https://github.com/openstack/nova/commit/b2acc9fa864b6fe10bc0c5f3786b976b472b1b27
- https://github.com/openstack/nova/commit/cf197ec2d682fb4da777df2291ca7ef101f73b77
- https://github.com/openstack/nova/commit/ef1ccdaca9512b88878155f7d8c2c77853d91252
- https://github.com/openstack/nova
More OpenStack Nova vulnerabilities
- TI-2026-34154 In OpenStack Nova before 33.0.2, the server create API does not strip certain hint data. CVSS 3.1HIGH 8.5
- TI-2022-23762 An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and… CVSS 3.1MEDIUM 5.7
- TI-2021-02596 Open redirect in openstack-nova CVSS 3.1MEDIUM 6.1
- TI-2017-04900 An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3… CVSS 3.0CRITICAL 9.8
- TI-2017-12516 An issue was discovered in the default FilterScheduler in OpenStack Nova 16.0.3. CVSS 3.0HIGH 8.6
- TI-2020-13145 An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova… CVSS 3.1HIGH 8.3
Sources
- CVE-2015-8749 · CVE Program
- CVE-2015-8749 · NVD
- FIRST EPSS
- GHSA-c36r-g737-9qp8 · GitHub Advisory Database · CC BY 4.0
- CVE-2015-8749 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences