CVE-2018-16856 Openstack Octavia allows Insertion of Sensitive Information into Log File
Attackers can read sensitive private keys from world-readable log files in default OpenStack Octavia installations, leading to information exposure.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-16856?
CVE-2018-16856 is a medium-severity vulnerability in Redhat Openstack, published on 26 Mar 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure.
Weakness: CWE-532
Which versions are affected by CVE-2018-16856?
5 open source packages ship an affected version, including octavia. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
octavia PyPI | All versions | 2.1.0 |
octavia PyPI | All versions | 2.1.0 |
octavia PyPI | From 3.0.0 | 3.0.2, 2.0.3 |
octavia PyPI | From 3.0.0.0b1 | 3.1.0 |
octavia PyPI | From 3.0.0.0b1 | 3.1.0 |
Linux distribution packages (22)
openstack-octavia Red Hat:openstack:13::el7 | All versions | 0:2.0.3-2.el7ost |
openstack-octavia-amphora-agent Red Hat:openstack:13::el7 | All versions | 0:2.0.3-2.el7ost |
openstack-octavia-api Red Hat:openstack:13::el7 | All versions | 0:2.0.3-2.el7ost |
openstack-octavia-common Red Hat:openstack:13::el7 | All versions | 0:2.0.3-2.el7ost |
openstack-octavia-debuginfo Red Hat:openstack:13::el7 | All versions | 0:2.0.3-2.el7ost |
openstack-octavia-diskimage-create Red Hat:openstack:13::el7 | All versions | 0:2.0.3-2.el7ost |
openstack-octavia-health-manager Red Hat:openstack:13::el7 | All versions | 0:2.0.3-2.el7ost |
openstack-octavia-housekeeping Red Hat:openstack:13::el7 | All versions | 0:2.0.3-2.el7ost |
openstack-octavia-worker Red Hat:openstack:13::el7 | All versions | 0:2.0.3-2.el7ost |
python-octavia Red Hat:openstack:13::el7 | All versions | 0:2.0.3-2.el7ost |
python-octavia-tests-golang Red Hat:openstack:13::el7 | All versions | 0:2.0.3-2.el7ost |
openstack-octavia Red Hat:openstack:14::el7 | All versions | 0:3.0.2-0.20181219195054.ec4c88e.el7ost |
openstack-octavia-amphora-agent Red Hat:openstack:14::el7 | All versions | 0:3.0.2-0.20181219195054.ec4c88e.el7ost |
openstack-octavia-api Red Hat:openstack:14::el7 | All versions | 0:3.0.2-0.20181219195054.ec4c88e.el7ost |
openstack-octavia-common Red Hat:openstack:14::el7 | All versions | 0:3.0.2-0.20181219195054.ec4c88e.el7ost |
openstack-octavia-debuginfo Red Hat:openstack:14::el7 | All versions | 0:3.0.2-0.20181219195054.ec4c88e.el7ost |
openstack-octavia-diskimage-create Red Hat:openstack:14::el7 | All versions | 0:3.0.2-0.20181219195054.ec4c88e.el7ost |
openstack-octavia-health-manager Red Hat:openstack:14::el7 | All versions | 0:3.0.2-0.20181219195054.ec4c88e.el7ost |
openstack-octavia-housekeeping Red Hat:openstack:14::el7 | All versions | 0:3.0.2-0.20181219195054.ec4c88e.el7ost |
openstack-octavia-worker Red Hat:openstack:14::el7 | All versions | 0:3.0.2-0.20181219195054.ec4c88e.el7ost |
python-octavia Red Hat:openstack:14::el7 | All versions | 0:3.0.2-0.20181219195054.ec4c88e.el7ost |
python-octavia-tests-golang Red Hat:openstack:14::el7 | All versions | 0:3.0.2-0.20181219195054.ec4c88e.el7ost |
Products include Openstack Octavia, Redhat Openstack.
How do I fix CVE-2018-16856?
Upgrade octavia to a fixed version for your release line: 2.1.0, 3.0.2, 2.0.3 or 3.1.0.
Is CVE-2018-16856 being exploited?
There is no known exploitation of CVE-2018-16856 in the wild and no public exploit code.
Other vulnerabilities in Redhat Openstack
Sources
Also known as GHSA-qcj3-h27m-mp9x, PYSEC-2019-193, RHSA-2019:0567, RHSA-2019:0593, UBUNTU-CVE-2018-16856.