What is GHSA-v933-vx5p-j7w2?

GHSA-v933-vx5p-j7w2 is a security advisory published by GitHub Security Advisories with Low severity. OpenStack Oslo utility sensitive information exposure via log files

Which CVE IDs does GHSA-v933-vx5p-j7w2 cover?

GHSA-v933-vx5p-j7w2 covers the following CVE IDs: CVE-2014-7231. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-v933-vx5p-j7w2?

GHSA-v933-vx5p-j7w2 affects 1 product, including: pip/oslo.utils:\u003c 0.2.0.

GHSA-v933-vx5p-j7w2Low

OpenStack Oslo utility sensitive information exposure via log files

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

May 14, 2024

🔗 CVE IDs covered (1)

CVE-2014-7231 →

📋 Description

The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log.

🎯 Affected products1

pip/oslo.utils:< 0.2.0

🔗 References (7)

https://nvd.nist.gov/vuln/detail/CVE-2014-7231
https://bugs.launchpad.net/oslo.utils/+bug/1345233
https://exchange.xforce.ibmcloud.com/vulnerabilities/96726
http://rhn.redhat.com/errata/RHSA-2014-1939.html
http://seclists.org/oss-sec/2014/q3/853
http://www.securityfocus.com/bid/70184
https://github.com/advisories/GHSA-v933-vx5p-j7w2