Lucene search

[email protected]CVE-2022-0718

HistoryAug 29, 2022 - 3:15 p.m.

CVE-2022-0718

2022-08-2915:15:00

CWE-532

[email protected]

web.nvd.nist.gov

116

flaw

python

oslo-utils

password

masking

debug logs

nvd

cve-2022-0718

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

5.1 Medium

AI Score

Confidence

High

3.3 Low

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

MULTIPLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:M/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

46.8%

JSON

A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.

VendorProductVersionCPE
openstackoslo\.utils*cpe:2.3:a:openstack:oslo\.utils:*:*:*:*:*:*:*:*
openstackoslo\.utils*cpe:2.3:a:openstack:oslo\.utils:*:*:*:*:*:*:*:*