GHSA-vcmv-6rxx-fh7r
Suggest an improvement- Source
- https://github.com/advisories/GHSA-vcmv-6rxx-fh7r
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-vcmv-6rxx-fh7r/GHSA-vcmv-6rxx-fh7r.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-vcmv-6rxx-fh7r
- Aliases
- Published
- 2022-04-22T00:24:18Z
- Modified
- 2024-05-08T20:12:35.598490Z
- Severity
-
- 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- OpenStack Nova Exposure of Sensitive Information to an Unauthorized Actor
- Details
-
OpenStack Nova before 2012.1 allows someone with access to an EC2ACCESSKEY (equivalent to a username) to obtain the EC2SECRETKEY (equivalent to a password). Exposing the EC2ACCESSKEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2SECRETKEY. An attacker could also presumably brute force values for EC2ACCESSKEY.
- Database specific
{ "nvd_published_at": "2019-11-26T04:15:00Z", "cwe_ids": [ "CWE-200" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-05-08T19:51:54Z" }- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2011-4076
- https://github.com/openstack/nova/commit/b1ab6da1495784ff581000018a6047fd19cf82c4
- https://github.com/openstack/nova/commit/beee11edbfdd82cd81bc9c0fd75912c167892c2b
- https://access.redhat.com/security/cve/cve-2011-4076
- https://bugs.launchpad.net/nova/+bug/868360
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-4076
- https://security-tracker.debian.org/tracker/CVE-2011-4076
- https://www.openwall.com/lists/oss-security/2011/10/25/4
Affected packages
PyPI / nova
Package
- Name
- nova
- View open source insights on deps.dev
- Purl
- pkg:pypi/nova