Information disclosure in Apache Libcloud

CVE-2013-6480

Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.

Vulnerability class: Information Disclosure

EPSS: 0.021 (79.4th percentile) — read the EPSS interpretation.

Affected products

Apache Libcloud — versions 0.12.3, 0.12.4, 0.13.0
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

secalert@redhat.com (vdb-entry, x_refsource_BID)
secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
secalert@redhat.com (mailing-list, x_refsource_BUGTRAQ)
secalert@redhat.com (x_refsource_MISC)
secalert@redhat.com (vendor-advisory, x_refsource_SUSE)
secalert@redhat.com (x_refsource_MISC)