An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x…
Priority LOW 33CWE-209Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 3 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-209.
Summary
An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environment may be leaked in the response, and could include sensitive configuration or other data.
Why it matters now
EPSS 0.01981 80th percentileScored 2026-11-07
Fix Partial nova (PyPI): 17.0.12, 18.2.2, 19.0.2Red Hat: 3 advisoriesRed Hat: 3 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | nova (PyPI) | before 17.0.12 | 17.0.12 | Patch available | GHSA-pg64-r7rr-phv8 |
| — | nova (PyPI) | 18.0.0 to before 18.2.2 | 18.2.2 | Patch available | GHSA-pg64-r7rr-phv8 |
| — | nova (PyPI) | 19.0.0 to before 19.0.2 | 19.0.2 | Patch available | GHSA-pg64-r7rr-phv8 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- nova (PyPI) Vendor— Affected before 17.0.12 Fixed in 17.0.12 Patch available GHSA-pg64-r7rr-phv8
- nova (PyPI) Vendor— Affected 18.0.0 to before 18.2.2 Fixed in 18.2.2 Patch available GHSA-pg64-r7rr-phv8
- nova (PyPI) Vendor— Affected 19.0.0 to before 19.0.2 Fixed in 19.0.2 Patch available GHSA-pg64-r7rr-phv8
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:* | before 17.0.12; 18.0.0 to before 18.2.2; 19.0.0 to before 19.0.2 | Vulnerable | OpenStack |
| cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* | 16.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* | 18.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* | 19.04 | Vulnerable | Canonical |
| cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:* | 10 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* | 13 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:* | 14 | Vulnerable | Red Hat |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
- cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:* Versions before 17.0.12; 18.0.0 to before 18.2.2; 19.0.0 to before 19.0.2 Vulnerable ·OpenStack
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* Versions 16.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* Versions 18.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:* Versions 19.04 Vulnerable ·Canonical
- cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:* Versions 10 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* Versions 13 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:* Versions 14 Vulnerable ·Red Hat
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-pg64-r7rr-phv8 nova (PyPI) Fixed in 17.0.12 Advisory →
- Fix · GHSA-pg64-r7rr-phv8 nova (PyPI) Fixed in 18.2.2 Advisory →
- Fix · GHSA-pg64-r7rr-phv8 nova (PyPI) Fixed in 19.0.2 Advisory →
Red Hat 3 advisories
- RHSA-2019:2622 Released 2019-09-04 · Red Hat rating Moderateopenstack-nova security and bug fix update
- Red Hat OpenStack Platform 13.0 openstack-nova-1:17.0.10-6.el7ost, openstack-nova-api-1:17.0.10-6.el7ost, openstack-nova-cells-1:17.0.10-6.el7ost +13
- RHSA-2019:2652 Released 2019-09-04 · Red Hat rating Moderateopenstack-nova security and bug fix update
- Red Hat OpenStack Platform 14.0 openstack-nova-1:18.2.1-0.20190509150817.8e130e2.el7ost, openstack-nova-api-1:18.2.1-0.20190509150817.8e130e2.el7ost, openstack-nova-cells-1:18.2.1-0.20190509150817.8e130e2.el7ost +13
- RHSA-2019:2631 Released 2019-09-04 · Red Hat rating Moderateopenstack-nova security and bug fix update
- Red Hat OpenStack Platform 10.0 openstack-nova-1:14.1.0-56.el7ost, openstack-nova-api-1:14.1.0-56.el7ost, openstack-nova-cells-1:14.1.0-56.el7ost +14
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenStack Platform 9 (Mitaka) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 10.0 | Fixed | RHSA-2019:2631 |
| Red Hat OpenStack Platform 13.0 | Fixed | RHSA-2019:2622 |
| Red Hat OpenStack Platform 14.0 | Fixed | RHSA-2019:2652 |
Not affected: 1 product
- Red Hat OpenStack Platform 15 (Stein)
Timeline
- 2026-10-02 Threatist record created from CVE-2019-14433
- 2026-10-03 Alias added: GHSA-pg64-r7rr-phv8
References
Advisory 7
Sources
- CVE-2019-14433 · CVE Program
- CVE-2019-14433 · NVD
- FIRST EPSS
- GHSA-pg64-r7rr-phv8 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-14433 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences