CVE-2022-3261: Plain-text passwords saved in /var/log/messages
A flaw was found in OpenStack. Multiple components show plain-text passwords in /var/log/messages during the OpenStack overcloud update run, leading to a disclosure of sensitive information problem.
Other sources
Description of problem:
There are multiple components that shows the plain-text passwords in /var/log/messages during openstack overcloud update run.
{'command': ['/bin/bash', '-c', "/usr/bin/virsh secret-define --file /etc/nova/secret.xml && /usr/bin/virsh secret-set-value --secret '3E4DB0C9-EA6B-4A8E-B3E1-FF8D5B3D2643' --base64 'SGVsbG8gdGhlcmUgOi0pCg=='"]
/usr/bin/redis-cli -s /var/run/redis/redis.sock -a <password> info
mysql --defaults-extra-file=/etc/my.cnf -nNE --connect-timeout=10 --user=clustercheck --password=<password> --host=localhost --port=3306 -e SHOW STATUS LIKE 'wsreplocalstate';
mysql -nNE --user=clustercheck --password=<password> -h localhost -e show status like 'wsrepclusterstatus';
Version-Release number of selected component (if applicable):
RHOSP16.2
How reproducible:
openstack overcloud update run
And check /var/log/messages
Actual results:
Passwords are visible in /var/log/messages
Expected results:
The passwords should be redacted or hidden otherwise.
Additional info:
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this flaw in OpenStack?
The vulnerability ID of this flaw in OpenStack is CVE-2022-3261.
What is the severity level of CVE-2022-3261?
The severity level of CVE-2022-3261 is high with a severity value of 7.5.
Which components of OpenStack are affected by CVE-2022-3261?
Multiple components of OpenStack are affected by CVE-2022-3261.
What is the impact of this vulnerability?
The vulnerability allows plain-text passwords to be disclosed in /var/log/messages during the OpenStack overcloud update run, leading to a disclosure of sensitive information problem.
Are there any fixes or patches available for CVE-2022-3261?
Yes, fixes and patches are available for CVE-2022-3261. Please refer to the provided references for more information.