GitHub Advisoryadvisory · PyPI

GHSA-f4g4-cj8f-3cr9 OpenStack Nova logs sensitive context from notification exceptions

CRITICAL Published 2022-05-14 Modified 2024-05-14 Official page ↗
Aliases
CVE-2017-7214
Ecosystem
PyPI
Packages
nova
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-532
Reviewed
2024-05-14

Affected packages

• PyPI nova: >= 13.0.0, < 13.1.4 → fixed in 13.1.4 • PyPI nova: >= 14.0.0, < 14.0.5 → fixed in 14.0.5 • PyPI nova: >= 15.0.1, < 15.0.2 → fixed in 15.0.2

Description

An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens.

Related

Alias · CVE (1)

  • CVE-2017-7214 An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References