OpenStack Oslo utility sensitive information exposure via log files

published 2014-10-08 12 y ago modified 2026-07-07 4 mo ago also GHSA-v933-vx5p-j7w2 , PYSEC-2026-892 , EUVD-2022-5321

cvss: 2.1; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 45%
public exploits: 0; none known

The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log.

Patch / fix

fixed in 4 distros 2

pypi oslo-utils 0.2.0
openstack cinder 2013.2.4, 2014.1.3
openstack nova 2013.2.4, 2014.1.3
openstack trove 2013.2.4, 2014.1.3

debian red hat

python-oslo.utils Debian 14, Debian 13, Debian 12 0.2.0-1

debian advisories DEBIAN-CVE-2014-7231

openstack-nova openstack 5 2014.1.3-4.el7ost
python-nova openstack 5 2014.1.3-4.el7ost
openstack-nova-api openstack 5 2014.1.3-4.el7ost
openstack-nova-cert openstack 5 2014.1.3-4.el7ost
openstack-nova-cells openstack 5 2014.1.3-4.el7ost
openstack-nova-common openstack 5 2014.1.3-4.el7ost
openstack-nova-compute openstack 5 2014.1.3-4.el7ost
openstack-nova-console openstack 5 2014.1.3-4.el7ost

red hat advisories RHSA-2014:1782 RHSA-2014:1781 RHSA-2014:1939 RHSA-2014:1788 RHSA-2014:1787

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-7231 updated 2026-08-10 cvss 2.1

Trove: potential leak of passwords into log files

Red Hat OpenStack Platform 4 openstack-nova, openstack-cinder
affected: no fix available
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 python-nova 2014.1.3-4.el6ost, python-cinder 2014.1.3-1.el6ost, openstack-nova 2014.1.3-4.el6ost, openstack-cinder 2014.1.3-1.el6ost, openstack-nova-api 2014.1.3-4.el6ost, openstack-nova-cert 2014.1.3-4.el6ost, +9 more
fixed: vendor fix RHSA-2014:1787
Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 python-nova 2014.1.3-4.el7ost, python-trove 2014.1.3-1.el7ost, python-cinder 2014.1.3-1.el7ost, openstack-nova 2014.1.3-4.el7ost, openstack-trove 2014.1.3-1.el7ost, openstack-cinder 2014.1.3-1.el7ost, +16 more
fixed: vendor fix RHSA-2014:1788

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.53% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

bugs.launchpad.net https://bugs.launchpad.net/oslo.utils/+bug/1345233 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	2.1	AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
pypi	oslo-utils	<0.2.0	0.2.0

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

bugs.launchpad.net /oslo.utils/+bug/1345233
web, exploit, third-party-advisory
rhn.redhat.com /errata/RHSA-2014-1939.html
vendor-advisory, web, third-party-advisory
seclists.org /oss-sec/2014/q3/853
mailing-list, web, third-party-advisory
exchange.xforce.ibmcloud.com /vulnerabilities/96726
vdb-entry, web, third-party-advisory
securityfocus.com /bid/70184
vdb-entry, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2014-7231
advisory
github.com /openstack/oslo.utils
package
pypi.org /project/oslo-utils
package
github.com /advisories/GHSA-v933-vx5p-j7w2
advisory

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary