id: PYSEC-2014-97
details: Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for
  the destroy DigitalOcean API, which allows local users to obtain sensitive information
  by leveraging a new VM.
affected:
- package:
    name: apache-libcloud
    ecosystem: PyPI
    purl: pkg:pypi/apache-libcloud
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: 0.12.3
    - fixed: 0.13.3
  versions:
  - 0.12.3
  - 0.12.4
  - 0.13.0
  - 0.13.1
  - 0.13.2
references:
- type: ARTICLE
  url: https://digitalocean.com/blog_posts/transparency-regarding-data-security
- type: WEB
  url: http://libcloud.apache.org/security.html
- type: REPORT
  url: https://github.com/fog/fog/issues/2525
- type: WEB
  url: http://www.securityfocus.com/bid/64617
- type: WEB
  url: http://lists.opensuse.org/opensuse-updates/2014-02/msg00015.html
- type: WEB
  url: http://www.securityfocus.com/archive/1/530624/100/0/threaded
- type: ADVISORY
  url: https://github.com/advisories/GHSA-g892-9h8m-r69r
aliases:
- CVE-2013-6480
- GHSA-g892-9h8m-r69r
modified: "2021-11-22T04:57:51.510127Z"
published: "2014-01-07T18:55:00Z"