GHSA-vcmv-6rxx-fh7r

Suggest an improvement
Source
https://github.com/advisories/GHSA-vcmv-6rxx-fh7r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-vcmv-6rxx-fh7r/GHSA-vcmv-6rxx-fh7r.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vcmv-6rxx-fh7r
Aliases
  • CVE-2011-4076
Published
2022-04-22T00:24:18Z
Modified
2024-05-08T20:12:35.598490Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
OpenStack Nova Exposure of Sensitive Information to an Unauthorized Actor
Details

OpenStack Nova before 2012.1 allows someone with access to an EC2ACCESSKEY (equivalent to a username) to obtain the EC2SECRETKEY (equivalent to a password). Exposing the EC2ACCESSKEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2SECRETKEY. An attacker could also presumably brute force values for EC2ACCESSKEY.

References

Affected packages

PyPI / nova

Package

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
12.0.0a0