REDHAT-BUG-2128834
First published: Wed Sep 21 2022(Updated: )
Description of problem: There are multiple components that shows the plain-text passwords in /var/log/messages during openstack overcloud update run. {'command': ['/bin/bash', '-c', "/usr/bin/virsh secret-define --file /etc/nova/secret.xml && /usr/bin/virsh secret-set-value --secret '3E4DB0C9-EA6B-4A8E-B3E1-FF8D5B3D2643' --base64 'SGVsbG8gdGhlcmUgOi0pCg=='"] /usr/bin/redis-cli -s /var/run/redis/redis.sock -a <password> info mysql --defaults-extra-file=/etc/my.cnf -nNE --connect-timeout=10 --user=clustercheck --password=<password> --host=localhost --port=3306 -e SHOW STATUS LIKE 'wsrep_local_state'; mysql -nNE --user=clustercheck --password=<password> -h localhost -e show status like 'wsrep_cluster_status'; Version-Release number of selected component (if applicable): RHOSP16.2 How reproducible: openstack overcloud update run And check /var/log/messages Actual results: Passwords are visible in /var/log/messages Expected results: The passwords should be redacted or hidden otherwise. Additional info:
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat OpenStack Platform 13 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-2128834?
The severity of REDHAT-BUG-2128834 is critical due to the exposure of plain-text passwords.
How do I fix REDHAT-BUG-2128834?
To fix REDHAT-BUG-2128834, update your Red Hat OpenStack Platform to the latest version that addresses this logging issue.
What components are affected by REDHAT-BUG-2128834?
REDHAT-BUG-2128834 affects multiple components of the Red Hat OpenStack Platform that log plain-text passwords.
Is there a workaround for REDHAT-BUG-2128834?
A recommended workaround for REDHAT-BUG-2128834 is to restrict access to the /var/log/messages file until a proper update is applied.
How does REDHAT-BUG-2128834 impact security?
REDHAT-BUG-2128834 impacts security by potentially allowing unauthorized access to sensitive credentials exposed in log files.
- agent/references
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2022-3261
- agent/last-modified-date
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat openstack platform 13