Description
An flaw was found in the OpenStack Platform (RHOSP) director, a toolset for installing and managing a complete RHOSP environment. Plaintext passwords may be stored in log files, which can expose sensitive information to anyone with access to the logs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | openstack-tripleo-heat-templates | — | 14.3.1-17.1.20240528170747.e7c7ce3.el9ost |
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 9 | — | — |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 17 | openstack-tripleo-heat-templates | 14.3.1-17.1.20240919130756.el9ost | RHSA-2024:9978 |
Advisories 2
- RHSA-2024:9978 Red Hat Security Advisory: RHOSP 17.1.4 (openstack-tripleo-heat-templates) security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- WID-SEC-2024-3517 Red Hat OpenStack: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Nov 20, 2024
References
- RHSA-2024:9978 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2024-4840 vdb-entry
- RHBZ#2280249 issue-tracking