Description
An issue was discovered in OpenStack Nova before 17.0.12, 18.x before 18.2.2, and 19.x before 19.0.2. If an API request from an authenticated user ends in a fault condition due to an external exception, details of the underlying environment may be leaked in the response, and could include sensitive configuration or other data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | nova | 2:19.0.2-1 | — |
| Debian 13 | nova | 2:19.0.2-1 | — |
| Debian 12 | nova | 2:19.0.2-1 | — |
| Debian 10 | nova | 2:18.1.0-6+deb10u1 | DLA-3109-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | nova | 2:17.0.10-0ubuntu2.1 | USN-4104-1 |
| Ubuntu 16.04 LTS | nova | 2:13.1.4-0ubuntu4.5 | USN-4104-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 14 | python-nova +15 | 1:18.2.1-0.20190509150817.8e130e2.el7ost | RHSA-2019:2652 |
| Red Hat OpenStack 13 | python-nova +15 | 1:17.0.10-6.el7ost | RHSA-2019:2622 |
| Red Hat OpenStack 10 | python-nova +16 | 1:14.1.0-56.el7ost | RHSA-2019:2631 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | nova | < 17.0.12 | 17.0.12 | GHSA-pg64-r7rr-phv8 |
| PyPI | nova | >= 18.0.0, < 18.2.2 | 18.2.2 | GHSA-pg64-r7rr-phv8 |
| PyPI | nova | >= 19.0.0, < 19.0.2 | 19.0.2 | GHSA-pg64-r7rr-phv8 |
| PyPI | nova | >= 19.0.0, < 19.0.2 · < 17.0.12 · >= 18.0.0, < 18.2.2 | 19.0.2, 17.0.12, 18.2.2 | PYSEC-2019-191 |
Advisories 5
- RHSA-2019:2631 Red Hat Security Advisory: openstack-nova security and bug fix update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2019:2652 Red Hat Security Advisory: openstack-nova security and bug fix update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2019:2622 Red Hat Security Advisory: openstack-nova security and bug fix update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- DLA-3109-1 nova - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4104-1 nova vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
References
- https://launchpad.net/bugs/1837877
- https://security.openstack.org/ossa/OSSA-2019-003.html
- [oss-security] 20190806 [OSSA-2019-003] Nova Server Resource Faults Leak External Exception Details (CVE-2019-14433) mailing-list
- USN-4104-1 vendor-advisory
- RHSA-2019:2631 vendor-advisory
- RHSA-2019:2622 vendor-advisory
- RHSA-2019:2652 vendor-advisory
- [debian-lts-announce] 20220915 [SECURITY] [DLA 3109-1] nova security update mailing-list