PT-2019-16740 · Openstack · Openstack Ceilometer

Published 2019-03-26 · Updated 2022-05-13 · CVE-2019-3830

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenStack Ceilometer versions prior to 12.0.0.0rc1

Description A vulnerability was found in ceilometer that results in an Information Exposure. The ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.

Recommendations For versions prior to 12.0.0.0rc1, update to version 12.0.0.0rc1 or later to resolve the issue. As a temporary workaround, consider configuring the logging settings to prevent sensitive data from being printed to log files. Restrict access to log files to minimize the risk of exploitation.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2019-3830

GHSA-2CVF-R9JM-4QM9

PYSEC-2019-78

PYSEC-2019-8

RHSA-2019:0566

RHSA-2019:0580

RHSA-2019:0919

Affected Products

Openstack Ceilometer

References · 13

• https://osv.dev/vulnerability/GHSA-2cvf-r9jm-4qm9 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-78 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2019-8 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3830 · Patch
• https://access.redhat.com/errata/RHSA-2019:0919 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-3830 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3830 · Security Note
• https://osv.dev/vulnerability/CVE-2019-3830 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-3830 · Vendor Advisory
• https://github.com/openstack/ceilometer · Note
• https://github.com/openstack/ceilometer/commit/8881a42af169a2d7c912b1434911f978883c83f3#diff-f2d2273521cce7e69f7032c6185936736a5acc70b2b2f90d956b9a7998b087cd · Note
• https://github.com/openstack/ceilometer/commit/8881a42af169a2d7c912b1434911f978883c83f3 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/ceilometer/PYSEC-2019-78.yaml · Note