CVE-2015-5160
libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.
- Score
- CVSS 3.0 5.5 Medium
- Status
- Modified - secalert@redhat.com
- Published
- 2018-08-20
- Last modified
- 2024-08-06
- Weaknesses
- CWE-200
Affected products
- Libvirt (Libvirt)
- Enterprise Linux (Redhat)
- Enterprise Linux Desktop (Redhat)
- Enterprise Linux Eus (Redhat)
- Enterprise Linux Server (Redhat)
- Enterprise Linux Server Aus (Redhat)
- Enterprise Linux Server Eus (Redhat)
- Enterprise Linux Server Tus (Redhat)
- Enterprise Linux Workstation (Redhat)
- Virtualization (Redhat)
References
- http://rhn.redhat.com/errata/RHSA-2016-2577.html
- http://www.openwall.com/lists/oss-security/2017/07/21/3
- https://bugs.launchpad.net/ossn/+bug/1686743
- https://bugzilla.redhat.com/show_bug.cgi?id=1245647
- https://wiki.openstack.org/wiki/OSSN/OSSN-0079
