PT-2017-17580 · Openstack · Openstack Nova

Matt Riedemann + 1 · Published 2017-03-21 · Updated 2022-05-14 · CVE-2017-7214

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Nova versions 13.x through 13.1.3 OpenStack Nova versions 14.x through 14.0.4 OpenStack Nova versions 15.x through 15.0.1

Description An issue in exception wrapper.py may cause legacy notification exception contexts to include sensitive information, such as account passwords and authorization tokens, in ERROR level logs.

Recommendations For versions 13.x through 13.1.3, update to a version later than 13.1.3 to resolve the issue. For versions 14.x through 14.0.4, update to a version later than 14.0.4 to resolve the issue. For versions 15.x through 15.0.1, update to a version later than 15.0.1 to resolve the issue.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2017-7214

GHSA-F4G4-CJ8F-3CR9

RHSA-2017:1508

RHSA-2017:1595

SUSE-SU-2017:1443-1

Affected Products

Openstack Nova

References · 24

• https://nvd.nist.gov/vuln/detail/CVE-2017-7214 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-7214 · Vendor Advisory
• https://launchpad.net/bugs/1673569 · Patch
• https://access.redhat.com/errata/RHSA-2017:1595 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-7214 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2017:1508 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-7214 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-7214 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f4g4-cj8f-3cr9 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7214 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1443-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-7214 · Vendor Advisory
• https://github.com/openstack/nova · Note
• https://github.com/openstack/nova/commit/e193201fa1de5b08b29adefd8c149935c5529598 · Note
• https://github.com/openstack/nova/commit/acb19160d4d348e29a21ad57c61c7369352c4d1c · Note