CVE-2015-9543: openstack nova
Vulnerability summary
CVE-2015-9543 is a low (CVSS 3.3) vulnerability in openstack nova. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 33.8% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 19-02-2020PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is related to NovaProxyRequestHandlerBase.new_websocket_client in console/websocketproxy.py.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · PypiEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
0.00 pp
From 0.41% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- nova< 2:20.1.1-1
Openstack1 product
- nova< 18.2.4 | ≥ 19.0.0, < 19.1.0 | ≥ 20.0.0, < 20.1.0
PyPI1 product
- nova< 18.2.4 | ≥ 19.0.0, < 19.1.0 | ≥ 20.0.0, < 20.1.0
Ubuntu1 product
- nova< 2:13.1.4-0ubuntu4.5+esm1 | < 2:17.0.13-0ubuntu5.3 | < 2:21.0.0~b1~git2019120415.45fb747c98-0ubuntu1
4 vendors · 4 products
References
14 links- www.openwall.com/lists/oss-security/2020/02/19/2Mailing ListX Refsource MLISTPatchThird Party AdvisoryWEB
- pypi.org/project/novaPACKAGE
