PT-2019-9378 · Openstack · Openstack Octavia

Sam Fowler · Publicado 2019-03-26 · Atualizado 2022-05-13 · CVE-2018-16856

Positive Technologies (AI Summary)

CVSS v4.0

8.7

Alta

Vetor base

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions openstack-octavia versions prior to 2.0.2-5 openstack-octavia versions prior to 3.0.1-0.20181009115732

Description The issue allows for information exposure due to log files being readable by all users. Sensitive information, such as private keys, can appear in these log files.

Recommendations For versions prior to 2.0.2-5, update to version 2.0.2-5 or later to resolve the issue. For versions prior to 3.0.1-0.20181009115732, update to version 3.0.1-0.20181009115732 or later to resolve the issue.

Correção

Insertion into Log File

Enumeração de Fraquezas

CWE-532

Identificadores relacionados

CVE-2018-16856

GHSA-QCJ3-H27M-MP9X

PYSEC-2019-193

RHSA-2019:0567

RHSA-2019:0593

Produtos afetados

Openstack Octavia

Referências · 13

• https://github.com/pypa/advisory-database/tree/main/vulns/octavia/PYSEC-2019-193.yaml · Nota
• https://github.com/openstack/octavia/commits/3.1.0 · Nota
• https://github.com/openstack/octavia/commit/ae7c87f54a6c5483a608d5e9fe51ea1966ea1f7e · Nota
• https://github.com/openstack/octavia · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1649165 · Nota
• https://osv.dev/vulnerability/PYSEC-2019-193 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-16856 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-16856 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-qcj3-h27m-mp9x · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16856 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16856 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2018-16856 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-16856 · Nota de Segurança