Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.
First Last Prev Next    This bug is not in your last search results.
Bug 1541402 - (CVE-2018-1000060) CVE-2018-1000060 sensu: Password exposure in warn level log when configured for multiple rabbitMQ connections
CVE-2018-1000060 sensu: Password exposure in warn level log when configured f...
Status: NEW
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20180120:1100,...
: Security
Depends On: 1541825 1541826 1541827
Blocks: 1541404
  Show dependency tree / graph
 
Reported: 2018-02-02 08:49 EST by Pedro Sampaio
Modified: 2018-05-17 11:25 EDT (History)
21 users (show)

See Also:
Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Sensu's redaction function fails to handle the redaction of sensitive data in deeply nested data structures, resulting in sensitive data, such as passwords, being logged in clear-text.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:0616 None None None 2018-03-28 15:04 EDT
Red Hat Product Errata RHSA-2018:1112 None None None 2018-04-11 13:45 EDT
Red Hat Product Errata RHSA-2018:1606 None None None 2018-05-17 11:25 EDT

  None (edit)
Description Pedro Sampaio 2018-02-02 08:49:27 EST 
A flaw was found in sensu 0.23.2. When multiple rabbitmq are configured in sensu, the password is written in plain text at Sensu Client logs.
Comment 2 Joshua Padman 2018-02-04 20:30:16 EST 
This issue affects the versions of sensu as shipped with Red Hat OpenStack Platform versions 7 through 12. Version 7 through 9 were released as a technical preview without support and will not be fixed.
Comment 4 Joshua Padman 2018-02-05 23:48:47 EST 
The issue is public on the upstream git repository.
https://github.com/sensu/sensu/issues/1804
Comment 5 Joshua Padman 2018-02-14 17:02:17 EST 
Acknowledgments:

Name: Debashis Pradhan (Huawei Technologies)
Comment 6 Joshua Padman 2018-02-14 17:16:53 EST 
External References:

https://sensuapp.org/docs/1.2/overview/changelog.html#core-v1-2-1-changes
Comment 7 errata-xmlrpc 2018-03-28 15:03:56 EDT 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 12.0 Operational Tools for RHEL 7

Via RHSA-2018:0616 https://access.redhat.com/errata/RHSA-2018:0616
Comment 8 errata-xmlrpc 2018-04-11 13:45:10 EDT 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 11.0 Operational Tools for RHEL 7

Via RHSA-2018:1112 https://access.redhat.com/errata/RHSA-2018:1112
Comment 9 errata-xmlrpc 2018-05-17 11:24:57 EDT 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 10.0 Operational Tools for RHEL 7

Via RHSA-2018:1606 https://access.redhat.com/errata/RHSA-2018:1606
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.