CVE-2022-0718 python-oslo-utils has improper password parsing
Improper password masking in debug logs exposes plaintext password segments, requiring debug mode to be enabled.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-0718?
CVE-2022-0718 is a medium-severity vulnerability in Debian Debian Linux, published on 29 Aug 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.
Which versions are affected by CVE-2022-0718?
3 open source packages ship an affected version, including oslo-utils. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
oslo-utils PyPI | All versions | 4.10.1 |
oslo-utils PyPI | All versions | 4.10.1 |
oslo-utils PyPI | All versions | 4.10.1 |
Linux distribution packages (12)
python-oslo-utils Red Hat:openstack:16.1::el8 | All versions | 0:3.41.6-1.20220426095230.f4deaad.el8ost |
python-oslo-utils-lang Red Hat:openstack:16.1::el8 | All versions | 0:3.41.6-1.20220426095230.f4deaad.el8ost |
python3-oslo-utils Red Hat:openstack:16.1::el8 | All versions | 0:3.41.6-1.20220426095230.f4deaad.el8ost |
python-oslo-utils Red Hat:openstack:16.2::el8 | All versions | 0:3.41.6-2.20220111011750.el8ost |
python-oslo-utils-lang Red Hat:openstack:16.2::el8 | All versions | 0:3.41.6-2.20220111011750.el8ost |
python3-oslo-utils Red Hat:openstack:16.2::el8 | All versions | 0:3.41.6-2.20220111011750.el8ost |
python-oslo.utils SUSE:Linux Enterprise Module for Public Cloud 15 SP3 | All versions | 4.1.1-150200.8.7.1 |
python-oslo.utils SUSE:Linux Enterprise Module for Public Cloud 15 SP4 | All versions | 4.1.1-150200.8.7.1 |
python-oslo.utils SUSE:Linux Enterprise Module for Public Cloud 15 SP5 | All versions | 4.1.1-150200.8.7.1 |
python-oslo.utils SUSE:Linux Enterprise Module for Public Cloud 15 SP6 | All versions | 4.1.1-150200.8.7.1 |
python-oslo.utils SUSE:Linux Enterprise Module for Public Cloud 15 SP7 | All versions | 4.1.1-150200.8.7.1 |
python-oslo.utils openSUSE:Leap 15.6 | All versions | 4.1.1-150200.8.7.1 |
Products include Debian Debian Linux, Openstack Oslo.utils, Redhat Openshift Container Platform, Redhat Openstack Platform.
How do I fix CVE-2022-0718?
Upgrade oslo-utils to 4.10.1 or later.
Is CVE-2022-0718 being exploited?
There is no known exploitation of CVE-2022-0718 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2022-0718, DLA-3106-1, DLA-3870-1, GHSA-wmqq-r32m-87c5, MGASA-2022-0189, PYSEC-2022-258 and 5 more.