PT-2019-16740 · Openstack · Openstack Ceilometer

Publicado 2019-03-26 · Atualizado 2022-05-13 · CVE-2019-3830

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Ceilometer versions prior to 12.0.0.0rc1

Description A vulnerability was found in ceilometer that results in an Information Exposure. The ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.

Recommendations For versions prior to 12.0.0.0rc1, update to version 12.0.0.0rc1 or later to resolve the issue. As a temporary workaround, consider configuring the logging settings to prevent sensitive data from being printed to log files. Restrict access to log files to minimize the risk of exploitation.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2019-3830

GHSA-2CVF-R9JM-4QM9

PYSEC-2019-78

PYSEC-2019-8

RHSA-2019:0566

RHSA-2019:0580

RHSA-2019:0919

Produtos afetados

Openstack Ceilometer

Referências · 13

• https://github.com/openstack/ceilometer · Nota
• https://github.com/openstack/ceilometer/commit/8881a42af169a2d7c912b1434911f978883c83f3#diff-f2d2273521cce7e69f7032c6185936736a5acc70b2b2f90d956b9a7998b087cd · Nota
• https://github.com/openstack/ceilometer/commit/8881a42af169a2d7c912b1434911f978883c83f3 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/ceilometer/PYSEC-2019-78.yaml · Nota
• https://osv.dev/vulnerability/GHSA-2cvf-r9jm-4qm9 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2019-78 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2019-8 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3830 · Correção
• https://access.redhat.com/errata/RHSA-2019:0919 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-3830 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-3830 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-3830 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-3830 · Aviso do Fabricante