CVE-2018-1000060 Information disclosure in n/a

Critical 9.8 Published 9 Feb 2018 Updated 5 Aug 2024

Attackers with log access can view sensitive configuration data like passwords due to improper redaction in Sensu Core.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-1000060?

CVE-2018-1000060 is a critical vulnerability in n/a, published on 9 Feb 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Sensu, Inc. Sensu Core version Before 1.2.0 & before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redact_sensitive() that can result in sensitive configuration data (e.g. passwords) may be logged in clear-text. This attack appear to be exploitable via victims with configuration matching a specific pattern will observe sensitive data outputted in their service log files. This vulnerability appears to have been fixed in 1.2.1 and later, after commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b.

Weakness: CWE-532

Which versions are affected by CVE-2018-1000060?

It affects 1 product.

Linux distribution packages (5)

`sensu` Red Hat:openstack-optools:10::el7	All versions	`0:0.23.2-4.el7ost`
`sensu` Red Hat:openstack-optools:11::el7	All versions	`0:0.27.0-4.el7ost`
`sensu-common` Red Hat:openstack-optools:11::el7	All versions	`0:0.27.0-4.el7ost`
`sensu` Red Hat:openstack-optools:12::el7	All versions	`0:0.27.0-4.el7ost`
`sensu-common` Red Hat:openstack-optools:12::el7	All versions	`0:0.27.0-4.el7ost`

Products include Sensu Sensu Core.

How do I fix CVE-2018-1000060?

Upgrade to a fixed version.

Is CVE-2018-1000060 being exploited?

There is no known exploitation of CVE-2018-1000060 in the wild and no public exploit code.

CVE-2018-1000209 Privilege escalation in n/a High 8.8

Sources

Also known as RHSA-2018:0616, RHSA-2018:1112, RHSA-2018:1606.