CVE-2019-3866: Medium severity red hat openstack mistral vulnerability

Published Nov 5, 2019
·
Updated

A vulnerability was discovered that all the data from the TripleO heat stack (user provided and generated passwords, certificates, ssh keys) are available in the mistral logs on the undercloud, in clear text.

Other sources

An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information.

Affected Software

9 affected componentsFixes available
redhat/openstack-mistral<0:9.0.2-0.20191125120837.6651519.el8
0:9.0.2-0.20191125120837.6651519.el8
redhat/mistral<7.1.0
7.1.0
redhat/mistral<8.1.0
8.1.0
redhat/mistral<9.0.1
9.0.1
redhat Openstack-mistral
redhat Openstack=10
redhat Openstack=13
redhat Openstack=14
redhat Openstack=15

Remediation

Information

Plain text information can be masked by ensuring that all mistral log files are not world readable.

Event History

Nov 7, 2019
CVE Published
12:00 AM
Nov 8, 2019
CVE Published
via MITRE·02:45 PM
Data Sourced
via MITRE·02:45 PM
DescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is CVE-2019-3866?

CVE-2019-3866 is an information-exposure vulnerability in openstack-mistral.

2

What is the severity of CVE-2019-3866?

CVE-2019-3866 has a severity score of 5.9 (medium).

3

How can a malicious system user exploit CVE-2019-3866?

A malicious system user could exploit CVE-2019-3866 by accessing sensitive user information stored in openstack-mistral's undercloud log files.

4

Which versions of openstack-mistral are affected by CVE-2019-3866?

Versions 7.1.0 up to 9.0.1 of openstack-mistral are affected by CVE-2019-3866.

5

How can I fix CVE-2019-3866?

To fix CVE-2019-3866, upgrade to version 9.0.2 or later of openstack-mistral.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203