zhmcclient logs password-like properties in clear text
CVE-2024-53865

8.3HIGH

Key Information:

Vendor

Zhmcclient

Status
Python-zhmcclient
Vendor
CVE Published:
29 November 2024

What is CVE-2024-53865?

The zhmcclient library, used for interfacing with IBM Z HMC Web Services API, has a vulnerability that allows sensitive password-like properties to be logged in clear text. This occurs under certain conditions when users create or update partitions, logical partitions (LPARs), or HMC user accounts within the library. Specific properties such as 'boot-ftp-password', 'ssc-master-pw', and 'bind-password' can be exposed in the log files if the corresponding logging functionality is enabled. The issue affects only users of the zhmcclient package who utilize specific API functions. An upgrade to zhmcclient version 1.18.1 is highly recommended to mitigate this risk, as there are currently no known workarounds.

Affected Version(s)

python-zhmcclient < 1.18.1

References

https://github.com/zhmcclient/python-zhmcclient/security/...
x_refsource_CONFIRM
https://github.com/zhmcclient/python-zhmcclient/commit/ad...
x_refsource_MISC

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.