PT-2019-9378 · Openstack · Openstack Octavia

Sam Fowler · Published 2019-03-26 · Updated 2022-05-13 · CVE-2018-16856

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions openstack-octavia versions prior to 2.0.2-5 openstack-octavia versions prior to 3.0.1-0.20181009115732

Description The issue allows for information exposure due to log files being readable by all users. Sensitive information, such as private keys, can appear in these log files.

Recommendations For versions prior to 2.0.2-5, update to version 2.0.2-5 or later to resolve the issue. For versions prior to 3.0.1-0.20181009115732, update to version 3.0.1-0.20181009115732 or later to resolve the issue.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2018-16856

GHSA-QCJ3-H27M-MP9X

PYSEC-2019-193

RHSA-2019:0567

RHSA-2019:0593

Affected Products

Openstack Octavia

References · 13

• https://osv.dev/vulnerability/PYSEC-2019-193 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-16856 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-16856 · Security Note
• https://osv.dev/vulnerability/GHSA-qcj3-h27m-mp9x · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-16856 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-16856 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-16856 · Security Note
• https://github.com/pypa/advisory-database/tree/main/vulns/octavia/PYSEC-2019-193.yaml · Note
• https://github.com/openstack/octavia/commits/3.1.0 · Note
• https://github.com/openstack/octavia/commit/ae7c87f54a6c5483a608d5e9fe51ea1966ea1f7e · Note
• https://github.com/openstack/octavia · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1649165 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16856 · Note