Password Logging Flaw in OpenStack Oslo Utility Library Products
CVE-2014-7231

Currently unrated

Key Information:

Vendor: Openstack
Status: Nova; Cinder; Trove
Vendor: CVE Published:; 8 October 2014

Summary

The strutils.mask_password function in the OpenStack Oslo utility library inadvertently reveals sensitive passwords in logged command outputs. This issue exists in Cinder, Nova, and Trove prior to the specified versions, enabling unauthorized local users to read these logs and potentially gain access to confidential information. Proper password masking is therefore critical to safeguard user credentials and maintain system integrity.

References

http://seclists.org/oss-sec/2014/q3/853

mailing-listx_refsource_MLIST

https://exchange.xforce.ibmcloud.com/vulnerabilities/96726

vdb-entryx_refsource_XF

http://rhn.redhat.com/errata/RHSA-2014-1939.html

vendor-advisoryx_refsource_REDHAT

Timeline

Vulnerability published
Oct 8, 2014
Vulnerability Reserved
Sep 29, 2014