Bug 1143673 (CVE-2019-14433)

Summary: VUL-0: CVE-2019-14433: openstack-nova: Nova Server Resource Faults Leak External Exception Details
Product: [Novell Products] SUSE Security Incidents Reporter: Alexandros Toptsoglou <atoptsoglou>
Component: IncidentsAssignee: Security Team bot <security-team>
Status: RESOLVED FIXED QA Contact: Security Team bot <security-team>
Severity: Normal    
Priority: P3 - Medium CC: bstephenson, gabriele.sonnu, JoDavis, kberger, wolfgang.frisch
Version: unspecified   
Target Milestone: ---   
Hardware: Other   
OS: Other   
URL: https://smash.suse.de/issue/238499
Whiteboard: CVSSv3:SUSE:CVE-2019-14433:6.5:(AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Comment 13 Joseph Davis 2019-08-06 21:47:20 UTC
Looks like the patches have been posted upstream in openstack/nova

stable/pike - https://review.opendev.org/#/c/674877/

Waiting for gates to pass and approvals to merge.
Comment 14 Alexandros Toptsoglou 2019-08-07 08:08:47 UTC
now public through oss
OSSA-2019-003: Nova Server Resource Faults Leak External Exception Details

:Date: August 06, 2019
:CVE: CVE-2019-14433

- Nova: <17.0.12,>=18.0.0<18.2.2,>=19.0.0<19.0.2

Donny Davis with Intel reported a vulnerability in Nova Compute
resource fault handling. If an API request from an authenticated user
ends in a fault condition due to an external exception, details of the
underlying environment may be leaked in the response and could include
sensitive configuration or other data.

- https://review.openstack.org/674908 (Ocata)
- https://review.openstack.org/674877 (Pike)
- https://review.openstack.org/674859 (Queens)
- https://review.openstack.org/674848 (Rocky)
- https://review.openstack.org/674828 (Stein)
- https://review.openstack.org/674821 (Train)

- Donny Davis from Intel (CVE-2019-14433)

- https://launchpad.net/bugs/1837877
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14433

- The stable/ocata and stable/pike branches are under extended maintenance and
  will receive no new point releases, but patches for them are provided as a
Comment 16 Gabriele Sonnu 2022-04-14 12:50:33 UTC