Bug 1434844 (CVE-2017-7214)

Summary:	CVE-2017-7214 openstack-nova: Sensitive information included in legacy notification exception contexts
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aortega, apevec, ayoung, berrange, chrisw, cvsbot-xmlrpc, dasmith, eglynn, gmollett, jjoyce, jschluet, kbasil, kchamart, lhh, lpeer, markmc, mbooth, nlevinki, rbryant, sbauza, sclewis, sferdjao, sgordon, slong, srevivo, tdecacqu, vromanso
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	An information exposure issue was discovered in OpenStack Compute's exception_wrapper.py. Legacy notification exception contexts appearing in ERROR-level logs could include sensitive information such as account passwords and authorization tokens.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-06-29 00:06:25 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1436944, 1436945, 1436946, 1436947
Bug Blocks:	1434846

Description Andrej Nemec 2017-03-22 13:14:02 UTC

An issue was discovered in exception_wrapper.py in OpenStack Nova. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens.

Upstream bug:

https://bugs.launchpad.net/nova/+bug/1673569

Comment 1 Summer Long 2017-03-29 05:18:44 UTC

Upstream Patches:
https://review.openstack.org/447075 (Mitaka)
https://review.openstack.org/447072 (Newton)
https://review.openstack.org/447071 (Ocata)

Comment 2 Summer Long 2017-03-29 05:21:07 UTC

Created openstack-nova tracking bugs for this issue:

Affects: openstack-rdo [bug 1436944]

Comment 10 errata-xmlrpc 2017-06-19 18:30:49 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 9.0 (Mitaka)

Via RHSA-2017:1508 https://access.redhat.com/errata/RHSA-2017:1508

Comment 11 errata-xmlrpc 2017-06-28 15:25:22 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 10.0 (Newton)

Via RHSA-2017:1595 https://access.redhat.com/errata/RHSA-2017:1595