Bug 1677389 (CVE-2019-3830)

Summary:	CVE-2019-3830 openstack-ceilometer: ceilometer-agent prints sensitive data from config files through log files
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	augol, dbecker, eglynn, jjoyce, jruzicka, jschluet, kbasil, lhh, lpeer, mburns, ntait, sclewis, slinaber, srevivo
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	openstack-ceilometer 10.0.1-6 11.0.2	Doc Type:	If docs needed, set a value
Doc Text:	A vulnerability was found in ceilometer where administrative credentials were permanently stored in the log. A user with access to the logs could obtain these credentials and escalate their privileges.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:48:02 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1677460, 1677461, 1677462, 1690575
Bug Blocks:	1677390

Description Laura Pardo 2019-02-14 17:25:25 UTC

A vulnerability was found in ceilometer. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.


References:
https://bugs.launchpad.net/ceilometer/+bug/1811098/

Upstream commit:
https://review.openstack.org/#/c/629891/

Comment 1 Nick Tait 2019-02-15 02:04:50 UTC

Affected versions are as follows:

openstack-ceilometer -> rhos
7.1.1 -> 10.0-rhel-7
10.0.1 -> 13.0-rhel-7
11.0.1 -> 14.0-rhel-7

Comment 3 errata-xmlrpc 2019-03-14 13:31:08 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 13.0 (Queens)

Via RHSA-2019:0566 https://access.redhat.com/errata/RHSA-2019:0566

Comment 4 errata-xmlrpc 2019-03-18 12:44:29 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 14.0 (Rocky)

Via RHSA-2019:0580 https://access.redhat.com/errata/RHSA-2019:0580

Comment 6 Nick Tait 2019-03-19 18:11:19 UTC

Created openstack-ceilometer tracking bugs for this issue:

Affects: openstack-rdo [bug 1690575]

Comment 11 errata-xmlrpc 2019-04-30 17:00:21 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 10.0 (Newton)

Via RHSA-2019:0919 https://access.redhat.com/errata/RHSA-2019:0919