VYPR
Low severityNVD Advisory· Published Jan 7, 2014· Updated Apr 29, 2026

CVE-2013-6480

CVE-2013-6480

Description

Libcloud 0.12.3 through 0.13.2 does not set the scrub_data parameter for the destroy DigitalOcean API, which allows local users to obtain sensitive information by leveraging a new VM.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
apache-libcloudPyPI
>= 0.12.3, < 0.13.30.13.3

Affected products

5
  • Apache/Libcloud5 versions
    cpe:2.3:a:apache:libcloud:0.12.3:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:apache:libcloud:0.12.3:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:libcloud:0.12.4:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:libcloud:0.13.0:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:libcloud:0.13.1:*:*:*:*:*:*:*
    • cpe:2.3:a:apache:libcloud:0.13.2:*:*:*:*:*:*:*

Patches

1
4449e165a007

Send 'scrub_data' parameter when destroying a DigitalOcean node.

https://github.com/apache/libcloudTomaz MurausDec 30, 2013via ghsa
3 files changed · +11 3
  • CHANGES+5 0 modified
    @@ -153,6 +153,11 @@ Changes with Apache Libcloud in development
          (LIBCLOUD-481, GITHUB-215)
          [Chris DeRamus]
     
    +   - Send "scrub_data" query parameter when destroying a DigitalOcean node.
    +     This will cause disk to be scrubbed (overwritten with 0's) when destroying
    +     a node. (LIBCLOUD-487)
    +     [Tomaz Muraus]
    +
       *) Storage
     
         - Allow user to specify 'Content-Disposition' header in the CloudFiles
    
  • libcloud/compute/drivers/digitalocean.py+3 1 modified
    @@ -122,7 +122,9 @@ def reboot_node(self, node):
             return res.status == httplib.OK
     
         def destroy_node(self, node):
    -        res = self.connection.request('/droplets/%s/destroy/' % (node.id))
    +        params = {'scrub_data': 'true'}
    +        res = self.connection.request('/droplets/%s/destroy/' % (node.id),
    +                                      params=params)
             return res.status == httplib.OK
     
         def ex_list_ssh_keys(self):
    
  • libcloud/test/compute/test_digitalocean.py+3 2 modified
    @@ -25,7 +25,7 @@
     from libcloud.common.types import InvalidCredsError
     from libcloud.compute.drivers.digitalocean import DigitalOceanNodeDriver
     
    -from libcloud.test import MockHttp
    +from libcloud.test import MockHttpTestCase
     from libcloud.test.file_fixtures import ComputeFileFixtures
     from libcloud.test.secrets import DIGITAL_OCEAN_PARAMS
     
    @@ -103,7 +103,7 @@ def test_ex_destroy_ssh_key(self):
             self.assertTrue(result)
     
     
    -class DigitalOceanMockHttp(MockHttp):
    +class DigitalOceanMockHttp(MockHttpTestCase):
         fixtures = ComputeFileFixtures('digitalocean')
     
         def _regions(self, method, url, body, headers):
    @@ -129,6 +129,7 @@ def _droplets_119461_reboot(self, method, url, body, headers):
     
         def _droplets_119461_destroy(self, method, url, body, headers):
             # destroy_node
    +        self.assertUrlContainsQueryParams(url, {'scrub_data': 'true'})
             body = self.fixtures.load('destroy_node.json')
             return (httplib.OK, body, {}, httplib.responses[httplib.OK])
     
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

15

News mentions

0

No linked articles in our index yet.