Description
The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-oslo.utils | 0.2.0-1 | — |
| Debian 13 | python-oslo.utils | 0.2.0-1 | — |
| Debian 12 | python-oslo.utils | 0.2.0-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 5 | python-cinder +2 | 2014.1.3-1.el6ost | RHSA-2014:1788, RHSA-2014:1787 |
| Red Hat OpenStack 5 | python-nova +13 | 2014.1.3-4.el6ost | RHSA-2014:1782, RHSA-2014:1781 |
| Red Hat OpenStack 5 | python-trove +6 | 2014.1.3-1.el7ost | RHSA-2014:1939 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | oslo-utils | < 0.2.0 | 0.2.0 | GHSA-v933-vx5p-j7w2 |
Advisories 5
- RHSA-2014:1782 Red Hat Security Advisory: openstack-nova security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2014:1781 Red Hat Security Advisory: openstack-nova security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2014:1787 Red Hat Security Advisory: openstack-cinder security and bug fix update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2014:1788 Red Hat Security Advisory: openstack-cinder security and bug fix update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2014:1939 Red Hat Security Advisory: openstack-trove security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
References
- [oss-security] 20140929 Re: CVE request for vulnerability in OpenStack Cinder, Nova and Trove mailing-list
- openstack-nova-cve20147231-info-disc(96726) vdb-entry
- RHSA-2014:1939 vendor-advisory
- https://bugs.launchpad.net/oslo.utils/+bug/1345233
- 70184 vdb-entry