OSSA-2017-002: Nova logs sensitive context from notification exceptions¶

Affects¶

• Nova: >=13.0.0 <=13.1.3, >=14.0.0 <=14.0.4, >=15.0.0 <=15.0.1

Description¶

Matt Riedemann with Huawei reported a vulnerability in Nova. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens. All Nova setups are affected.

Patches¶

• https://review.openstack.org/447075 (Mitaka)
• https://review.openstack.org/447072 (Newton)
• https://review.openstack.org/447071 (Ocata)
• https://review.openstack.org/446948 (Pike)

Credits¶

• Matt Riedemann from Huawei (CVE-2017-7214)

References¶

• https://launchpad.net/bugs/1673569
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7214