OpenStack Nova logs sensitive context from notification exceptions
Critical severity
GitHub Reviewed
Published
May 14, 2022
to the GitHub Advisory Database
•
Updated May 14, 2024
Package
Affected versions
>= 13.0.0, < 13.1.4
>= 14.0.0, < 14.0.5
>= 15.0.1, < 15.0.2
Patched versions
13.1.4
14.0.5
15.0.2
Description
Published by the National Vulnerability Database
Mar 21, 2017
Published to the GitHub Advisory Database
May 14, 2022
Reviewed
May 14, 2024
Last updated
May 14, 2024
An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens.
References