CVE-2024-1141 Glance-store: glance store access key logged in debug log level

2024-02-0114:21:37

CWE-779

redhat

www.cve.org

cve-2024-1141

glance-store

debug log

access key

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

5.7

Confidence

High

EPSS

Percentile

15.5%

JSON

A vulnerability was found in python-glance-store. The issue occurs when the package logs the access_key for the glance-store when the DEBUG log level is enabled.

CNA Affected

[
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "python-glance-store",
    "defaultStatus": "affected",
    "versions": [
      {
        "version": "0:2.5.1-17.1.20230621023901.el9ost",
        "lessThan": "*",
        "versionType": "rpm",
        "status": "unaffected"
      }
    ],
    "cpes": [
      "cpe:/a:redhat:openstack:17.1::el9"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 16.1",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "python-glance-store",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/a:redhat:openstack:16.1"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 16.2",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "python-glance-store",
    "defaultStatus": "unknown",
    "cpes": [
      "cpe:/a:redhat:openstack:16.2"
    ]
  },
  {
    "vendor": "Red Hat",
    "product": "Red Hat OpenStack Platform 18.0",
    "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
    "packageName": "python-glance-store",
    "defaultStatus": "affected",
    "cpes": [
      "cpe:/a:redhat:openstack:18.0"
    ]
  }
]