GHSA-g892-9h8m-r69r

Source

https://github.com/advisories/GHSA-g892-9h8m-r69r

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-g892-9h8m-r69r/GHSA-g892-9h8m-r69r.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-g892-9h8m-r69r

Aliases

CVE-2013-6480
PYSEC-2014-97

Published

2022-05-14T02:54:05Z

Modified

2024-12-08T05:31:24Z

Summary

Libcloud does not properly scrub data when destroying a DigitalOcean node

Details

Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.

Database specific

{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-02-23T20:54:12Z",
    "nvd_published_at":  "2014-01-07T18:55:00Z",
    "severity":  "LOW"
}

References

Affected packages

PyPI / apache-libcloud

Package

Name: apache-libcloud; View open source insights on deps.dev
Purl: pkg:pypi/apache-libcloud

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0.12.3

Fixed

0.13.3

Affected versions

0.*

0.12.3

0.12.4

0.13.0

0.13.1

0.13.2

Database specific

last_known_affected_version_range

"<= 0.13.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-g892-9h8m-r69r/GHSA-g892-9h8m-r69r.json"