CVE-2014-7231

The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log.

CVSS v2.0 2.1 LOW

2.1^/10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/70184	Third Party Advisory VDB Entry
http://seclists.org/oss-sec/2014/q3/853	Mailing List Third Party Advisory
https://bugs.launchpad.net/oslo.utils/+bug/1345233	Exploit Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1939.html	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/96726	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openstack:cinder::::::::
	cpe:2.3:a:openstack:nova::::::::
	cpe:2.3:a:openstack:trove::::::::
	cpe:2.3:a:openstack:cinder::::::::
	cpe:2.3:a:openstack:nova::::::::
	cpe:2.3:a:openstack:trove::::::::

Configuration 2 (hide)

cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*

Information

Published : 2014-10-08 12:55

Updated : 2018-11-16 07:28

NVD link : CVE-2014-7231

Mitre link : CVE-2014-7231

JSON object : View

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Products Affected

openstack

trove
nova
cinder

redhat

openstack

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/70184", "name": "70184", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://seclists.org/oss-sec/2014/q3/853", "name": "[oss-security] 20140929 Re: CVE request for vulnerability in OpenStack Cinder, Nova and Trove", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "https://bugs.launchpad.net/oslo.utils/+bug/1345233", "name": "https://bugs.launchpad.net/oslo.utils/+bug/1345233", "tags": ["Exploit", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "http://rhn.redhat.com/errata/RHSA-2014-1939.html", "name": "RHSA-2014:1939", "tags": ["Third Party Advisory"], "refsource": "REDHAT"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/96726", "name": "openstack-nova-cve20147231-info-disc(96726)", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-200"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-7231", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "LOW", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2014-10-08T19:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:openstack:cinder:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2013.2.4", "versionStartIncluding": "2013.2"}, {"cpe23Uri": "cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2013.2.4", "versionStartIncluding": "2013.2"}, {"cpe23Uri": "cpe:2.3:a:openstack:trove:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2013.2.4", "versionStartIncluding": "2013.2"}, {"cpe23Uri": "cpe:2.3:a:openstack:cinder:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2014.1.3", "versionStartIncluding": "2014.1"}, {"cpe23Uri": "cpe:2.3:a:openstack:nova:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2014.1.3", "versionStartIncluding": "2014.1"}, {"cpe23Uri": "cpe:2.3:a:openstack:trove:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "2014.1.3", "versionStartIncluding": "2014.1"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-11-16T15:28Z"}

2.1 /10