PT-2017-17580 · Openstack · Openstack Nova

Matt Riedemann + 1 · Publicado 2017-03-21 · Atualizado 2022-05-14 · CVE-2017-7214

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Nova versions 13.x through 13.1.3 OpenStack Nova versions 14.x through 14.0.4 OpenStack Nova versions 15.x through 15.0.1

Description An issue in exception wrapper.py may cause legacy notification exception contexts to include sensitive information, such as account passwords and authorization tokens, in ERROR level logs.

Recommendations For versions 13.x through 13.1.3, update to a version later than 13.1.3 to resolve the issue. For versions 14.x through 14.0.4, update to a version later than 14.0.4 to resolve the issue. For versions 15.x through 15.0.1, update to a version later than 15.0.1 to resolve the issue.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2017-7214

GHSA-F4G4-CJ8F-3CR9

RHSA-2017:1508

RHSA-2017:1595

SUSE-SU-2017:1443-1

Produtos afetados

Openstack Nova

Referências · 24

• https://github.com/openstack/nova · Nota
• https://github.com/openstack/nova/commit/e193201fa1de5b08b29adefd8c149935c5529598 · Nota
• https://github.com/openstack/nova/commit/acb19160d4d348e29a21ad57c61c7369352c4d1c · Nota
• https://github.com/openstack/nova/commit/3f985f1eda6f29180878a3d21c20c5057179486a · Nota
• https://github.com/openstack/nova/commit/c2c91ce44592fc5dc2aacee1cf7f5b5cfd2e9a0a · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7214 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7214 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2017-7214 · Nota
• https://bugzilla.suse.com/1030406 · Nota
• https://launchpad.net/bugs/1673569 · Correção
• https://access.redhat.com/errata/RHSA-2017:1595 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2017-7214 · Aviso do Fabricante
• http://securityfocus.com/bid/96998 · Nota
• https://access.redhat.com/errata/RHSA-2017:1508 · Aviso do Fabricante
• https://bugzilla.suse.com/1024328 · Nota