CVE Vulnerabilities

CVE-2018-16856

Insertion of Sensitive Information into Log File

Published: Mar 26, 2019 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
5.5 MODERATE
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Ubuntu
MEDIUM

In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure.

Weakness

The product writes sensitive information to a log file.

Affected Software

Name Vendor Start Version End Version
Octavia Openstack 2.0.0 (including) 2.0.2-5 (excluding)
Octavia Openstack 3.0.0 (including) 3.0.1-0.20181009115732 (excluding)
Red Hat OpenStack Platform 13.0 (Queens) RedHat openstack-octavia-0:2.0.3-2.el7ost *
Red Hat OpenStack Platform 14.0 (Rocky) RedHat openstack-octavia-0:3.0.2-0.20181219195054.ec4c88e.el7ost *
Octavia Ubuntu cosmic *
Octavia Ubuntu disco *
Octavia Ubuntu eoan *
Octavia Ubuntu focal *
Octavia Ubuntu groovy *
Octavia Ubuntu hirsute *
Octavia Ubuntu impish *
Octavia Ubuntu kinetic *
Octavia Ubuntu lunar *
Octavia Ubuntu mantic *
Octavia Ubuntu oracular *

Potential Mitigations

References