OpenStack Compute (nova)

  1. Series mitaka
  2. Bug #1516765
  3. Comment #15

Comment 15 for bug 1516765

Revision history for this message
Grant Murphy (gmurphy) wrote : Re: xenapi: volume_utils._parse_volume_info can leak connection password via StorageError

lol sorry matt.

Title: Xen connection password leak in logs via StorageError
Reporter: Matt Riedemann (IBM)
Products: Nova
Affects: >= 2014.2 <= 2015.1.2, ==12.0.0

Description:
Matt Riedemann from IBM reported an information disclosure vulnerability
in Nova. If a StorageError occurs when attempting to connect a volume
using the Xen API, the connection parameters will be logged. These
parameters may include credentials that are not masked. An attacker
with read access to Nova logs could use these credentials with the
Xen API directly. Only Nova deployments using the Xen backend are
affected by this flaw.