CVE-2014-7231 OpenStack Oslo utility sensitive information exposure via log files
LowCVSS 2.1
EPSS 0.53%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi oslo-utils(PyPI) | < 0.2.0 | 0.2.0 |
| pypi oslo-utils(PyPI) | = 0.1.0 | No fix listed |
| pypi oslo-utils(PyPI) | = 0.1.1 | No fix listed |
| pypi oslo.utils(PyPI) | < 0.2.0 | 0.2.0 |
| debian/python-oslo.utils(Debian:12) | < 0.2.0-1 | 0.2.0-1 |
| debian/python-oslo.utils(Debian:13) | < 0.2.0-1 | 0.2.0-1 |
| debian/python-oslo.utils(Debian:14) | < 0.2.0-1 | 0.2.0-1 |
| OpenStack cinder | >= 2013.2, < 2013.2.4 | 2013.2.4 |
| OpenStack cinder | >= 2014.1, < 2014.1.3 | 2014.1.3 |
| OpenStack Nova | >= 2013.2, < 2013.2.4 | 2013.2.4 |
| OpenStack Nova | >= 2014.1, < 2014.1.3 | 2014.1.3 |
| OpenStack trove | >= 2013.2, < 2013.2.4 | 2013.2.4 |
| OpenStack trove | >= 2014.1, < 2014.1.3 | 2014.1.3 |
| redhat openstack | = 5.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugs.launchpad.net exploit third-party-advisory
- openstack-nova-cve20147231-info-disc(96726) third-party-advisory vdb-entry
- github.com product
- RHSA-2014:1939 third-party-advisory vendor-advisory
- [oss-security] 20140929 Re: CVE request for vulnerability in OpenStack Cinder, Nova and Trove mailing-list third-party-advisory
- 70184 third-party-advisory vdb-entry
- pypi.org product
- github.com vendor-advisory
- Debian Security Tracker CVE-2014-7231 vendor-advisory