GHSA-vcmv-6rxx-fh7r

Suggest an improvement
Source
https://github.com/advisories/GHSA-vcmv-6rxx-fh7r
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-vcmv-6rxx-fh7r/GHSA-vcmv-6rxx-fh7r.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-vcmv-6rxx-fh7r
Aliases
Published
2022-04-22T00:24:18Z
Modified
2026-07-06T08:11:25Z
Severity
  • 5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
OpenStack Nova Exposure of Sensitive Information to an Unauthorized Actor
Details

OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivalent to a password). Exposing the EC2_ACCESS_KEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2_SECRET_KEY. An attacker could also presumably brute force values for EC2_ACCESS_KEY.

Database specific 
{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2024-05-08T19:51:54Z",
    "nvd_published_at":  "2019-11-26T04:15:00Z",
    "severity":  "MODERATE"
}
References

Affected packages

PyPI / nova

Package

Name
nova
View open source insights on deps.dev
Purl
pkg:pypi/nova

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
12.0.0a0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/04/GHSA-vcmv-6rxx-fh7r/GHSA-vcmv-6rxx-fh7r.json"