CVE-2019-14433

An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environment may be leaked in the response, and could include sensitive configuration or other data.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.5 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 69%
VendorProductVersion
openstacknova
𝑥
< 17.0.12
openstacknova
18.0.0 ≤
𝑥
< 18.2.2
openstacknova
19.0.0 ≤
𝑥
< 19.0.2
canonicalubuntu_linux
16.04
canonicalubuntu_linux
18.04
canonicalubuntu_linux
19.04
debiandebian_linux
10.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
nova
bullseye
2:22.0.1-2+deb11u1
fixed
stretch
no-dsa
jessie
no-dsa
bullseye (security)
2:22.4.0-1~deb11u5
fixed
bookworm
2:26.2.2-1~deb12u3
fixed
bookworm (security)
2:26.2.2-1~deb12u3
fixed
sid
2:30.0.0-1
fixed
trixie
2:30.0.0-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
nova
disco
Fixed 2:19.0.1-0ubuntu2.1
released
bionic
Fixed 2:17.0.10-0ubuntu2.1
released
xenial
Fixed 2:13.1.4-0ubuntu4.5
released
trusty
dne