CVE-2018-16856: High severity opendev octavia vulnerability

Q: What is the severity of CVE-2018-16856?

CVE-2018-16856 is classified as a high severity vulnerability due to the exposure of sensitive information in log files.

Q: How do I fix CVE-2018-16856?

To fix CVE-2018-16856, update OpenStack Octavia to version 2.1.0 or later, or 3.1.0 or later.

Q: What are the vulnerable versions of OpenStack Octavia in CVE-2018-16856?

The vulnerable versions of OpenStack Octavia are prior to 2.0.2-5 and prior to 3.0.1-0.20181009115732.

Q: What sensitive information is exposed due to CVE-2018-16856?

CVE-2018-16856 can expose sensitive information such as private keys through readable log files.

Q: Which OpenStack versions are affected by CVE-2018-16856?

Red Hat OpenStack versions 12, 13, and 14 are affected by CVE-2018-16856.

Published Mar 26, 2019

Updated

In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure.

Affected Software

7 affected componentsFixes available

pip/octavia<2.1.0

2.1.0

pip/octavia>=3.0.0.0b1<3.1.0

3.1.0

Openstack Octavia>=2.0.0<2.0.2-5

Openstack Octavia>=3.0.0<3.0.1-0.20181009115732

redhat Openstack=12

redhat Openstack=13

redhat Openstack=14

Event History

Mar 26, 2019

CVE Published

via MITRE·05:45 PM

Data Sourced

via MITRE·05:45 PM

DescriptionSeverityWeakness

May 13, 2022

Advisory Published

via GitHub·01:07 AM

Frequently Asked Questions

What is the severity of CVE-2018-16856?

CVE-2018-16856 is classified as a high severity vulnerability due to the exposure of sensitive information in log files.

How do I fix CVE-2018-16856?

To fix CVE-2018-16856, update OpenStack Octavia to version 2.1.0 or later, or 3.1.0 or later.

What are the vulnerable versions of OpenStack Octavia in CVE-2018-16856?