VulnerabilityModified

CVE-2014-7230

The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a ProcessExecutionError by reading the log.

LOW 2.1EPSS 0.47%

Does this matter?

Lower severity and a low EPSS score (0.47%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 2.0: 2.1 LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
EPSS: 0.47% probability · 39th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: openstack/cinder · openstack/nova · openstack/trove · redhat/openstack · canonical/ubuntu linux
Source: cve@mitre.org

References

http://rhn.redhat.com/errata/RHSA-2014-1939.htmlThird Party Advisory
http://seclists.org/oss-sec/2014/q3/853Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/70185Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2405-1Third Party Advisory
https://bugs.launchpad.net/oslo-incubator/+bug/1343604Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/96725Third Party Advisory, VDB Entry
http://rhn.redhat.com/errata/RHSA-2014-1939.htmlThird Party Advisory
http://seclists.org/oss-sec/2014/q3/853Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/70185Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2405-1Third Party Advisory
https://bugs.launchpad.net/oslo-incubator/+bug/1343604Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/96725Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.