Description
The volume_utils._parse_volume_info function in OpenStack Compute (Nova) before 2015.1.3 (kilo) and 12.0.x before 12.0.1 (liberty) includes the connection_info dictionary in the StorageError message when using the Xen backend, which might allow attackers to obtain sensitive password information by reading log files or other unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nova | 2:13.0.0~rc3-1 | — |
| Debian 13 | nova | 2:13.0.0~rc3-1 | — |
| Debian 12 | nova | 2:13.0.0~rc3-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | nova | 1:2014.1.5-0ubuntu1.7 | USN-3449-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | nova | >= 12.0.0, < 12.0.1 | 12.0.1 | GHSA-c36r-g737-9qp8 |
Advisories 1
- USN-3449-1 nova vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026