CVE-2019-14433: canonical ubuntu_linux
CVSS: 6.5v3.1MediumModified
AliasesGHSA-pg64-r7rr-phv8PYSEC-2019-191RHSA-2019:2622RHSA-2019:2631RHSA-2019:2652UBUNTU-CVE-2019-14433USN-4104-1DEBIAN-CVE-2019-14433DLA-3109-1
Published 09-08-2019Last modified 05-08-2024
Vulnerability summary
CVE-2019-14433 is a medium (CVSS 6.5) vulnerability in canonical ubuntu_linux. EPSS estimates a 1.94% chance of exploitation in the next 30 days, higher than 79.8% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (NVD)EPSS score
1.94%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 09-08-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environment may be leaked in the response, and could include sensitive configuration or other data.
CVSS metrics
8 scores · 5 sources · 4 versionsHigh 7.1Preferred score · OSV · Pypi (Ecosystem advisory) · calculated from vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:NSourcesSingle source
Medium 6.5Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NSourcesAll 4 agree
- OSV · PypiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Medium 6.5Preferred score · OSV · Red hat (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NSourcesAll 2 agree
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Medium 4.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
1.94%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
0.00 pp
From 1.94% on 19-09-2026
19-09-202619-10-2026
EPSS score1.94%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat18 products
- openstack10 | 13 | 14
- openstack-nova< 1:17.0.10-6.el7ost | < 1:14.1.0-56.el7ost | < 1:18.2.1-0.20190509150817.8e130e2.el7ost
- openstack-nova-api< 1:17.0.10-6.el7ost | < 1:14.1.0-56.el7ost | < 1:18.2.1-0.20190509150817.8e130e2.el7ost
- openstack-nova-cells< 1:17.0.10-6.el7ost | < 1:14.1.0-56.el7ost | < 1:18.2.1-0.20190509150817.8e130e2.el7ost
- openstack-nova-cert< 1:14.1.0-56.el7ost
Debian2 products
- nova< 2:19.0.2-1 | < 2:18.1.0-6+deb10u1
- debian_linuxEOL10.0
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 19.04
Openstack1 product
- nova< 17.0.12 | ≥ 18.0.0, < 18.2.2 | ≥ 19.0.0, < 19.0.2
PyPI1 product
- nova< 17.0.12 | ≥ 19.0.0, < 19.0.2 | ≥ 18.0.0, < 18.2.2
Ubuntu1 product
- nova< 2:13.1.4-0ubuntu4.5 | < 2:17.0.10-0ubuntu2.1
6 vendors · 24 products
References
30 links- www.openwall.com/lists/oss-security/2019/08/06/6Mailing ListX Refsource MLISTThird Party AdvisoryWEB
- access.redhat.com/errata/RHSA-2019:2631Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEBAdvisory
- access.redhat.com/errata/RHSA-2019:2622Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEBAdvisory
- access.redhat.com/errata/RHSA-2019:2652Vendor AdvisoryX Refsource REDHATThird Party AdvisoryWEBAdvisory
lists.debian.org/debian-lts-announce/2022/09/msg00018.htmlMailing ListX Refsource MLISTThird Party AdvisoryWEB
Show all 30 references
- github.com/openstack/novaPACKAGE