CVE-2014-7231 OpenStack Oslo utility sensitive information exposure via log files
Local attackers can read unmasked passwords from logs due to improper masking in the OpenStack Oslo utility library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-7231?
CVE-2014-7231 is a low-severity vulnerability in Redhat Openstack, published on 8 Oct 2014. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log.
Weakness: CWE-200
Which versions are affected by CVE-2014-7231?
3 open source packages ship an affected version, including oslo-utils and oslo.utils. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
oslo-utils PyPI | All versions | 0.2.0 |
oslo-utils PyPI | All versions | 0.2.0 |
oslo.utils PyPI | All versions | 0.2.0 |
Products include Openstack Cinder, Openstack Nova, Openstack Trove, Redhat Openstack.
How do I fix CVE-2014-7231?
Upgrade oslo-utils to 0.2.0 or later.
Is CVE-2014-7231 being exploited?
There is no known exploitation of CVE-2014-7231 in the wild and no public exploit code.
Other vulnerabilities in Redhat Openstack
- CVE-2015-5162 OpenStack Cinder, Glance, and Nova contain Uncontrolled Resource Consumption
- CVE-2024-32498 OpenStack Cinder, Glance, and Nova vulnerable to arbitrary file access
- CVE-2017-15139 Information disclosure in openstack-cinder
- CVE-2014-3641 OpenStack Cinder Exposure of Sensitive Information to an Unauthorized Actor vulnerability
- CVE-2013-4183 OpenStack Cinder LVMVolumeDriver does not zero deleted snapshots
Sources
Also known as DEBIAN-CVE-2014-7231, GHSA-v933-vx5p-j7w2, PYSEC-2026-892.