~ / search / GHSA-qcj3-h27m-mp9x

GHSA-qcj3-h27m-mp9x

Openstack Octavia allows Insertion of Sensitive Information into Log File

Source: GitHub Advisory Database (reviewed) High CVE-2018-16856

Packages

EcosystemPackageAffectedFixed in
PyPI octavia < 2.1.0 2.1.0
PyPI octavia >= 3.0.0.0b1, < 3.1.0 3.1.0

Details

As written in the advisory (Markdown source, shown as plain text).

In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure.

References

External links from the advisory. They lead to third-party sites.