Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1nODkyLTloOG0tcjY5cs4AAWKU
Libcloud does not properly scrub data when destroying a DigitalOcean node
Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter
for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1nODkyLTloOG0tcjY5cs4AAWKU
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Low
Classification: General
Published: almost 2 years ago
Updated: 3 months ago
Identifiers: GHSA-g892-9h8m-r69r, CVE-2013-6480
References:
- https://nvd.nist.gov/vuln/detail/CVE-2013-6480
- https://github.com/fog/fog/issues/2525
- http://libcloud.apache.org/security.html
- http://lists.opensuse.org/opensuse-updates/2014-02/msg00015.html
- https://github.com/apache/libcloud/commit/4449e165a00756dc61430e6ad9520f005b045d29
- https://github.com/apache/libcloud/blob/abba8c1719a8bda6db8efde2d46fd1b423ae4304/CHANGES.rst#compute-48
- https://issues.apache.org/jira/browse/LIBCLOUD-487
- https://web.archive.org/web/20131230232003/https://digitalocean.com/blog_posts/transparency-regarding-data-security
- https://web.archive.org/web/20140129025443/http://www.securityfocus.com/bid/64617
- https://web.archive.org/web/20201209074449/http://www.securityfocus.com/archive/1/530624/100/0/threaded
- https://github.com/advisories/GHSA-g892-9h8m-r69r
Blast Radius: 0.0
Affected Packages
pypi:apache-libcloud
Dependent packages: 27Dependent repositories: 2,071
Downloads: 233,276 last month
Affected Version Ranges: >= 0.12.3, <= 0.13.2
Fixed in: 0.13.3
All affected versions: 0.12.3, 0.12.4, 0.13.0, 0.13.1, 0.13.2
All unaffected versions: 0.3.1, 0.4.0, 0.4.2, 0.5.0, 0.5.2, 0.6.1, 0.6.2, 0.7.1, 0.8.0, 0.9.1, 0.10.1, 0.11.0, 0.11.1, 0.11.3, 0.11.4, 0.12.1, 0.13.3, 0.14.0, 0.14.1, 0.15.0, 0.15.1, 0.16.0, 0.17.0, 0.18.0, 0.19.0, 0.20.0, 0.20.1, 1.0.0, 1.1.0, 1.2.1, 1.3.0, 1.4.0, 1.5.0, 2.0.0, 2.1.0, 2.2.0, 2.2.1, 2.3.0, 2.4.0, 2.5.0, 2.6.0, 2.6.1, 2.7.0, 2.8.0, 2.8.1, 2.8.2, 2.8.3, 3.0.0, 3.1.0, 3.2.0, 3.3.0, 3.3.1, 3.4.0, 3.4.1, 3.5.0, 3.5.1, 3.6.0, 3.6.1, 3.7.0, 3.8.0