Password Logging Flaw in OpenStack Oslo Utility Library Products
CVE-2014-7231

Currently unrated

Key Information:

Vendor
Openstack
Status
Nova
Cinder
Trove
Vendor
CVE Published:
8 October 2014

Summary

The strutils.mask_password function in the OpenStack Oslo utility library inadvertently reveals sensitive passwords in logged command outputs. This issue exists in Cinder, Nova, and Trove prior to the specified versions, enabling unauthorized local users to read these logs and potentially gain access to confidential information. Proper password masking is therefore critical to safeguard user credentials and maintain system integrity.

References

http://seclists.org/oss-sec/2014/q3/853
mailing-listx_refsource_MLIST
https://exchange.xforce.ibmcloud.com/vulnerabilities/96726
vdb-entryx_refsource_XF
http://rhn.redhat.com/errata/RHSA-2014-1939.html
vendor-advisoryx_refsource_REDHAT

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.