Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API,
    which allows local users to obtain sensitive information by leveraging a new VM. (CVE-2013-6480)

- Updated to 0.13.3 (bnc#857209, CVE-2013-6480)

  + Security fix release, for destroying nodes on     digitalOcean 'data_scrub' method is always invoked

  - Require python-setuptools instead of distribute     (upstreams merged)

  - Updated to 0.13.2

  - General :

  - Don't sent Content-Length: 0 header with POST and PUT     request if 'raw' mode is used. This fixes a regression     which could cause broken behavior in some storage driver     when uploading a file from disk.

  - Compute :

  - Added Ubuntu Linux 12.04 image to ElasticHost driver     image list. (LIBCLOUD-364)

  - Update ElasticHosts driver to store drive UUID in the     node 'extra' field. (LIBCLOUD-357)

  - Storage :

  - Store last_modified timestamp in the Object extra     dictionary in the S3 driver. (LIBCLOUD-373)

  - Load Balancer :

  - Expose CloudStack driver directly through the     Provider.CLOUDSTACK constant.

  - DNS :

  - Modify Zerigo driver to include record TTL in the record     'extra' attribute if a record has a TTL set.

  - Modify values in the Record 'extra' dictionary attribute     in the Zerigo DNS driver to be set to None instead of an     empty string ('') if a value for the provided key is not     set.

Security Fix - BUG: 1047867 1047868

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
434582	SCA: security update for apache-libcloud (GHSA-g892-9h8m-r69r)	Tenable Cloud Security	SCA Checks	medium
434582	SCA: security update for apache-libcloud (GHSA-g892-9h8m-r69r)	Tenable Self-Hosted Container Security	SCA Checks	medium
75250	openSUSE Security Update : python-apache-libcloud (openSUSE-SU-2014:0198-1)	Nessus	SuSE Local Security Checks	low
71917	Fedora 18 : python-libcloud-0.13.3-1.fc18 (2014-0159)	Nessus	Fedora Local Security Checks	low
71916	Fedora 19 : python-libcloud-0.13.3-1.fc19 (2014-0136)	Nessus	Fedora Local Security Checks	low
71915	Fedora 20 : python-libcloud-0.13.3-1.fc20 (2014-0129)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2013-6480

medium

Tenable Plugins

medium

medium

low

low

low

low