GCVE - cpe:2.3:a:openstack:trove:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:openstack:trove:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Openstack (`7b0cf974-b2b5-592e-bdf4-6953805ef02a`)
Product	Trove (`92362f9e-c9bd-5504-9b8f-4b7fae732c16`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:github/openstack/trove`	purl2cpe	2026-06-01 10:17:03.742329
`pkg:pypi/trove`	purl2cpe	2026-06-01 10:17:03.742332
`pkg:rpm/opensuse/openstack-trove`	purl2cpe	2026-06-01 10:17:03.742335

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-3156`	vulnerable	2026-06-03 14:34:49.319591	Details available The _write_config function in trove/guestagent/datastore/experimental/mongodb/service.py, reset_configuration function in trove/guestagent/datastore/experimental/postgresql/service/config.py, write_config function in trove/guestagent/datastore/experimental/redis/service.py, _write_mycnf function in trove/guestagent/datastore/mysql/service.py, InnoBackupEx::_run_prepare function in trove/guestagent/strategies/restore/mysql_impl.py, InnoBackupEx::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, MySQLDump::cmd in trove/guestagent/strategies/backup/mysql_impl.py, InnoBackupExIncremental::cmd function in trove/guestagent/strategies/backup/mysql_impl.py, _get_actual_db_status function in trove/guestagent/datastore/experimental/cassandra/system.py and trove/guestagent/datastore/experimental/cassandra/service.py, and multiple class CbBackup methods in trove/guestagent/strategies/backup/experimental/couchbase_impl.py in Openstack DBaaS (aka Trove) as packaged in Openstack before 2015.1.0 (aka Kilo) allows local users to write to configuration files via a symlink attack on a temporary file. Published: 2017-08-11T21:00:00.000Z Updated: 2024-08-06T05:39:31.070Z Open on db.gcve.eu Reference links https://github.com/openstack/trove/blob/master/trove/guestagent/datastore/mysql/service.py#L790 https://github.com/openstack/trove/blob/master/trove/guestagent/strategies/backup/mysql_impl.py#L110 https://github.com/openstack/trove/blob/master/trove/guestagent/datastore/experimental/cassandra/service.py#L230 https://github.com/openstack/trove/blob/master/trove/guestagent/strategies/backup/mysql_impl.py#L55 https://bugs.launchpad.net/trove/+bug/1398195	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-7231`	vulnerable	2026-06-03 14:34:15.312001	Details available The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log. Published: 2014-10-08T19:00:00.000Z Updated: 2024-08-06T12:40:19.265Z Open on db.gcve.eu Reference links http://seclists.org/oss-sec/2014/q3/853 https://exchange.xforce.ibmcloud.com/vulnerabilities/96726 http://rhn.redhat.com/errata/RHSA-2014-1939.html https://bugs.launchpad.net/oslo.utils/+bug/1345233 http://www.securityfocus.com/bid/70184	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-7230`	vulnerable	2026-06-03 14:34:15.310899	Details available The processutils.execute function in OpenStack oslo-incubator, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 allows local users to obtain passwords from commands that cause a ProcessExecutionError by reading the log. Published: 2014-10-08T19:00:00.000Z Updated: 2024-08-06T12:40:19.269Z Open on db.gcve.eu Reference links http://seclists.org/oss-sec/2014/q3/853 https://exchange.xforce.ibmcloud.com/vulnerabilities/96725 http://www.securityfocus.com/bid/70185 https://bugs.launchpad.net/oslo-incubator/+bug/1343604 http://rhn.redhat.com/errata/RHSA-2014-1939.html	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.