Description
Sensu, Inc. Sensu Core version Before 1.2.0 & before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redact_sensitive() that can result in sensitive configuration data (e.g. passwords) may be logged in clear-text. This attack appear to be exploitable via victims with configuration matching a specific pattern will observe sensitive data outputted in their service log files. This vulnerability appears to have been fixed in 1.2.1 and later, after commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Openstack-optools 12 | sensu +1 | 0.27.0-4.el7ost | RHSA-2018:0616 |
| Red Hat Openstack-optools 11 | sensu +1 | 0.27.0-4.el7ost | RHSA-2018:1112 |
| Red Hat Openstack-optools 10 | sensu | 0.23.2-4.el7ost | RHSA-2018:1606 |
Advisories 3
- RHSA-2018:1606 Red Hat Security Advisory: sensu security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2018:1112 Red Hat Security Advisory: sensu security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2018:0616 Red Hat Security Advisory: sensu security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- https://github.com/sensu/sensu/pull/1810
- RHSA-2018:0616 vendor-advisory
- https://github.com/sensu/sensu/issues/1804
- RHSA-2018:1606 vendor-advisory
- RHSA-2018:1112 vendor-advisory