Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.9
CVE-2022-0718: Sensitive Passwords Leaked in Debug Logs of python-oslo-utils
CVE-2022-0718 · published 4 years ago
Summary
The python-oslo-utils software incorrectly masks passwords in debug logs if they contain a double quote. This can expose sensitive password information to unauthorized users. To fix the issue, update python-oslo-utils to the latest version.
What to do
- Update openstack oslo-utils to version 4.10.1.
- Update debian python-oslo.utils to version 4.10.1-1.
- Update openstack oslo.utils to version 4.10.1 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | openstack | oslo-utils |
< 4.10.1 Fix: upgrade to 4.10.1
|
| – | openstack | oslo.utils |
< 4.10.1 4.12.0 cpe:2.3:a:openstack:oslo.utils:*:*:*:*:*:*:*:* |
| – | redhat | openshift_container_platform |
4.0 cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:* |
| – | redhat | openstack_platform |
16.1 cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:* |
| – | debian | debian_linux |
10.0 11.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| Debian:12 | debian | python-oslo.utils |
< 4.10.1-1 Fix: upgrade to 4.10.1-1
|
Original advisory text
A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double ...
A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.
References
- https://github.com/pypa/advisory-database/tree/main/vulns/oslo-utils/PYSEC-2022-...
- https://access.redhat.com/errata/RHSA-2022:0993
- https://access.redhat.com/errata/RHSA-2022:8873
- https://github.com/advisories/GHSA-wmqq-r32m-87c5
- https://access.redhat.com/security/cve/CVE-2022-0718 URL
- https://bugs.launchpad.net/oslo.utils/+bug/1949623 URL
- https://opendev.org/openstack/oslo.utils/commit/6e17ae1f7959c64dfd20a5f67edf422e... URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0718.j... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-0718 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2056850 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/09/msg00015.html Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2022-0718 Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-522Insufficiently Protected Credentials
CWE-532Insertion of Sensitive Information into Log File
Timeline
Published29 Aug 2022
Updated30 Oct 2026
First seen6 Mar 2026
Sources
CVE-2022-0718 · OSV
GHSA-wmqq-r32m-87c5 · GHSA
CVE-2022-0718 · NVD
DEBIAN-CVE-2022-0718 · OSV
Track software like this
Free during beta