GitHub Advisoryadvisory · PyPI

GHSA-wmqq-r32m-87c5 python-oslo-utils has improper password parsing

MEDIUM Published 2022-08-29 Modified 2024-10-08 Official page ↗

Aliases: CVE-2022-0718
Ecosystem: PyPI
Packages: oslo-utils
Severity: Moderate
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Weaknesses: CWE-522, CWE-532
Reviewed: 2022-09-16

Affected packages

• PyPI oslo-utils: < 4.10.1 → fixed in 4.10.1

Description

A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext

Alias · CVE (1)

CVE-2022-0718 A flaw was found in python-oslo-utils. vulnerability

Weakness · CWE (2)

CWE-522 Insufficiently Protected Credentials weakness
CWE-532 Insertion of Sensitive Information into Log File weakness

References

https://nvd.nist.gov/vuln/detail/CVE-2022-0718 advisory
https://access.redhat.com/errata/RHSA-2022:0993 web
https://access.redhat.com/errata/RHSA-2022:8873 web
https://access.redhat.com/security/cve/CVE-2022-0718 web
https://bugs.launchpad.net/oslo.utils/+bug/1949623 web
https://bugzilla.redhat.com/show_bug.cgi?id=2056850 web
https://github.com/advisories/GHSA-wmqq-r32m-87c5 advisory
https://github.com/openstack/oslo.utils package
https://github.com/pypa/advisory-database/tree/main/vulns/oslo-utils/PYSEC-2022-258.yaml web
https://lists.debian.org/debian-lts-announce/2022/09/msg00015.html web
https://opendev.org/openstack/oslo.utils/commit/6e17ae1f7959c64dfd20a5f67edf422e702426aa web
https://security-tracker.debian.org/tracker/CVE-2022-0718 web