GitHub Advisoryadvisory · PyPI

GHSA-v933-vx5p-j7w2 OpenStack Oslo utility sensitive information exposure via log files

LOW Published 2022-05-14 Modified 2024-05-14 Official page ↗
Aliases
CVE-2014-7231
Ecosystem
PyPI
Packages
oslo.utils
Severity
Low
Weaknesses
CWE-200
Reviewed
2024-05-14

Affected packages

• PyPI oslo.utils: < 0.2.0 → fixed in 0.2.0

Description

The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log.

Related

Alias · CVE (1)

  • CVE-2014-7231 The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References