CVE Vulnerabilities

CVE-2018-16856

Insertion of Sensitive Information into Log File

Published: Mar 26, 2019 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
5.5 MODERATE
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Ubuntu
MEDIUM

In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure.

Weakness

Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

Affected Software

Name Vendor Start Version End Version
Octavia Openstack 2.0.0 (including) 2.0.2-5 (excluding)
Octavia Openstack 3.0.0 (including) 3.0.1-0.20181009115732 (excluding)
Red Hat OpenStack Platform 13.0 (Queens) RedHat openstack-octavia-0:2.0.3-2.el7ost *
Red Hat OpenStack Platform 14.0 (Rocky) RedHat openstack-octavia-0:3.0.2-0.20181219195054.ec4c88e.el7ost *
Octavia Ubuntu cosmic *
Octavia Ubuntu disco *
Octavia Ubuntu eoan *
Octavia Ubuntu groovy *
Octavia Ubuntu hirsute *
Octavia Ubuntu impish *
Octavia Ubuntu kinetic *
Octavia Ubuntu lunar *
Octavia Ubuntu mantic *

Extended Description

While logging all information may be helpful during development stages, it is important that logging levels be set appropriately before a product ships so that sensitive user data and system information are not accidentally exposed to potential attackers. Different log files may be produced and stored for:

Potential Mitigations

References