CVE-2014-7231

OpenStack Oslo utility library issue CVE-2014-7231 affects Cinder, Nova, and Trove before versions 2013.2.4 and 2014.1 before 2014.1.3. The strutils.mask_password() function did not properly mask passwords in command logs, enabling a local user with read access to logs to retrieve passwords. Reme...

CVE-2014-7230

CVE-2014-7230 affects OpenStack components (oslo-incubator, Cinder, Nova, Trove). The vulnerability arises in processutils.execute where certain commands that trigger a ProcessExecutionError may write passwords to logs, allowing local attackers to read them. Mitigations involve upgrading to upstr...

CVE-2015-3156

CVE-2015-3156 affects OpenStack Trove (DBaaS) as packaged in OpenStack before 2015.1.0 (Kilo). A local attacker could write to configuration files via a symlink attack on a temporary file. The description lists multiple vulnerable components (e.g., _write_config in trove/guestagent/datastore/expe...