Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2017-7214

critical

CVE-2017-7214

openstack-nova: Sensitive information included in legacy notification exception contexts

Published Modified CWE 532
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.1CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N

Trivy's own label is CRITICAL. Rated critical by NVD, GHSA. Rated lower by Red Hat (medium).

Description

An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens.

Affected packages and fixed versions

SourcePackageFixed in
pip::GitHub Security Advisory pipnova13.1.4, 14.0.5, 15.0.2
debian 11nova2:14.0.0-4
debian 12nova2:14.0.0-4
debian 13nova2:14.0.0-4
debian 14nova2:14.0.0-4
debian 7novano fix listed
echonova2:14.0.0-4
Red Hatopenstack-nova, openstack-nova-api, openstack-nova-cells and 14 moreno fix listed
Show all 24 entries from 8 sources
SourcePackageFixed in
pip::GitHub Security Advisory pipnova13.1.4, 14.0.5, 15.0.2
debian 11nova2:14.0.0-4
debian 12nova2:14.0.0-4
debian 13nova2:14.0.0-4
debian 14nova2:14.0.0-4
debian 7novano fix listed
echonova2:14.0.0-4
Red Hatopenstack-novano fix listed
Red Hatopenstack-nova-apino fix listed
Red Hatopenstack-nova-cellsno fix listed
Red Hatopenstack-nova-commonno fix listed
Red Hatopenstack-nova-computeno fix listed
Red Hatopenstack-nova-conductorno fix listed
Red Hatopenstack-nova-consoleno fix listed
Red Hatopenstack-nova-migrationno fix listed
Red Hatopenstack-nova-networkno fix listed
Red Hatopenstack-nova-novncproxyno fix listed
Red Hatopenstack-nova-placement-apino fix listed
Red Hatopenstack-nova-schedulerno fix listed
Red Hatopenstack-nova-serialproxyno fix listed
Red Hatopenstack-nova-spicehtml5proxyno fix listed
Red Hatpython-novano fix listed
Red Hatpython-nova-testsno fix listed
Red Hatpython3-novano fix listed

References

All 12 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.