CVE-2014-7231 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2014-7231 Interim 1 8 2022-10-15T17:13:48Z current 2021-05-30T13:23:15Z 2022-10-15T17:13:48Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2014-7231 The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2014-November/001072.html E-Mail link for SUSE-SU-2014:1467-1 https://lists.suse.com/pipermail/sle-security-updates/2015-February/001238.html E-Mail link for SUSE-SU-2015:0324-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE OpenStack Cloud 4 SUSE OpenStack Cloud 6 openstack-cinder-2014.1.4.dev19.g80c0054-0.7.1 openstack-cinder-7.0.2~a0~dev1-1.2 openstack-cinder-api-2014.1.4.dev19.g80c0054-0.7.1 openstack-cinder-api-7.0.2~a0~dev1-1.2 openstack-cinder-backup-2014.1.4.dev19.g80c0054-0.7.1 openstack-cinder-backup-7.0.2~a0~dev1-1.2 openstack-cinder-doc-2014.1.4.dev19.g80c0054-0.7.1 openstack-cinder-scheduler-2014.1.4.dev19.g80c0054-0.7.1 openstack-cinder-scheduler-7.0.2~a0~dev1-1.2 openstack-cinder-volume-2014.1.4.dev19.g80c0054-0.7.1 openstack-cinder-volume-7.0.2~a0~dev1-1.2 openstack-nova-12.0.2~a0~dev18-1.3 openstack-nova-2014.1.4.dev49-0.7.1 openstack-nova-api-12.0.2~a0~dev18-1.3 openstack-nova-api-2014.1.4.dev49-0.7.1 openstack-nova-cells-12.0.2~a0~dev18-1.3 openstack-nova-cells-2014.1.4.dev49-0.7.1 openstack-nova-cert-12.0.2~a0~dev18-1.3 openstack-nova-cert-2014.1.4.dev49-0.7.1 openstack-nova-compute-12.0.2~a0~dev18-1.3 openstack-nova-compute-2014.1.4.dev49-0.7.1 openstack-nova-conductor-12.0.2~a0~dev18-1.3 openstack-nova-conductor-2014.1.4.dev49-0.7.1 openstack-nova-console-12.0.2~a0~dev18-1.3 openstack-nova-console-2014.1.4.dev49-0.7.1 openstack-nova-consoleauth-12.0.2~a0~dev18-1.3 openstack-nova-consoleauth-2014.1.4.dev49-0.7.1 openstack-nova-doc-2014.1.4.dev49-0.7.1 openstack-nova-novncproxy-12.0.2~a0~dev18-1.3 openstack-nova-novncproxy-2014.1.4.dev49-0.7.1 openstack-nova-objectstore-12.0.2~a0~dev18-1.3 openstack-nova-objectstore-2014.1.4.dev49-0.7.1 openstack-nova-scheduler-12.0.2~a0~dev18-1.3 openstack-nova-scheduler-2014.1.4.dev49-0.7.1 openstack-nova-serialproxy-12.0.2~a0~dev18-1.3 openstack-nova-vncproxy-12.0.2~a0~dev18-1.3 openstack-nova-vncproxy-2014.1.4.dev49-0.7.1 openstack-trove-4.0.1~a0~dev2-2.1 openstack-trove-api-4.0.1~a0~dev2-2.1 openstack-trove-conductor-4.0.1~a0~dev2-2.1 openstack-trove-guestagent-4.0.1~a0~dev2-2.1 openstack-trove-taskmanager-4.0.1~a0~dev2-2.1 python-cinder-2014.1.4.dev19.g80c0054-0.7.1 python-cinder-7.0.2~a0~dev1-1.2 python-nova-12.0.2~a0~dev18-1.3 python-nova-2014.1.4.dev49-0.7.1 python-trove-4.0.1~a0~dev2-2.1 openstack-cinder-2014.1.4.dev19.g80c0054-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-cinder-api-2014.1.4.dev19.g80c0054-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-cinder-backup-2014.1.4.dev19.g80c0054-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-cinder-doc-2014.1.4.dev19.g80c0054-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-cinder-scheduler-2014.1.4.dev19.g80c0054-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-cinder-volume-2014.1.4.dev19.g80c0054-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-nova-2014.1.4.dev49-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-nova-api-2014.1.4.dev49-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-nova-cells-2014.1.4.dev49-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-nova-cert-2014.1.4.dev49-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-nova-compute-2014.1.4.dev49-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-nova-conductor-2014.1.4.dev49-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-nova-console-2014.1.4.dev49-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-nova-consoleauth-2014.1.4.dev49-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-nova-doc-2014.1.4.dev49-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-nova-novncproxy-2014.1.4.dev49-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-nova-objectstore-2014.1.4.dev49-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-nova-scheduler-2014.1.4.dev49-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-nova-vncproxy-2014.1.4.dev49-0.7.1 as a component of SUSE OpenStack Cloud 4 python-cinder-2014.1.4.dev19.g80c0054-0.7.1 as a component of SUSE OpenStack Cloud 4 python-nova-2014.1.4.dev49-0.7.1 as a component of SUSE OpenStack Cloud 4 openstack-cinder-7.0.2~a0~dev1-1.2 as a component of SUSE OpenStack Cloud 6 openstack-cinder-api-7.0.2~a0~dev1-1.2 as a component of SUSE OpenStack Cloud 6 openstack-cinder-backup-7.0.2~a0~dev1-1.2 as a component of SUSE OpenStack Cloud 6 openstack-cinder-scheduler-7.0.2~a0~dev1-1.2 as a component of SUSE OpenStack Cloud 6 openstack-cinder-volume-7.0.2~a0~dev1-1.2 as a component of SUSE OpenStack Cloud 6 openstack-nova-12.0.2~a0~dev18-1.3 as a component of SUSE OpenStack Cloud 6 openstack-nova-api-12.0.2~a0~dev18-1.3 as a component of SUSE OpenStack Cloud 6 openstack-nova-cells-12.0.2~a0~dev18-1.3 as a component of SUSE OpenStack Cloud 6 openstack-nova-cert-12.0.2~a0~dev18-1.3 as a component of SUSE OpenStack Cloud 6 openstack-nova-compute-12.0.2~a0~dev18-1.3 as a component of SUSE OpenStack Cloud 6 openstack-nova-conductor-12.0.2~a0~dev18-1.3 as a component of SUSE OpenStack Cloud 6 openstack-nova-console-12.0.2~a0~dev18-1.3 as a component of SUSE OpenStack Cloud 6 openstack-nova-consoleauth-12.0.2~a0~dev18-1.3 as a component of SUSE OpenStack Cloud 6 openstack-nova-novncproxy-12.0.2~a0~dev18-1.3 as a component of SUSE OpenStack Cloud 6 openstack-nova-objectstore-12.0.2~a0~dev18-1.3 as a component of SUSE OpenStack Cloud 6 openstack-nova-scheduler-12.0.2~a0~dev18-1.3 as a component of SUSE OpenStack Cloud 6 openstack-nova-serialproxy-12.0.2~a0~dev18-1.3 as a component of SUSE OpenStack Cloud 6 openstack-nova-vncproxy-12.0.2~a0~dev18-1.3 as a component of SUSE OpenStack Cloud 6 openstack-trove-4.0.1~a0~dev2-2.1 as a component of SUSE OpenStack Cloud 6 openstack-trove-api-4.0.1~a0~dev2-2.1 as a component of SUSE OpenStack Cloud 6 openstack-trove-conductor-4.0.1~a0~dev2-2.1 as a component of SUSE OpenStack Cloud 6 openstack-trove-guestagent-4.0.1~a0~dev2-2.1 as a component of SUSE OpenStack Cloud 6 openstack-trove-taskmanager-4.0.1~a0~dev2-2.1 as a component of SUSE OpenStack Cloud 6 python-cinder-7.0.2~a0~dev1-1.2 as a component of SUSE OpenStack Cloud 6 python-nova-12.0.2~a0~dev18-1.3 as a component of SUSE OpenStack Cloud 6 python-trove-4.0.1~a0~dev2-2.1 as a component of SUSE OpenStack Cloud 6 The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log. CVE-2014-7231 SUSE OpenStack Cloud 4:openstack-cinder-2014.1.4.dev19.g80c0054-0.7.1 SUSE OpenStack Cloud 4:openstack-cinder-api-2014.1.4.dev19.g80c0054-0.7.1 SUSE OpenStack Cloud 4:openstack-cinder-backup-2014.1.4.dev19.g80c0054-0.7.1 SUSE OpenStack Cloud 4:openstack-cinder-doc-2014.1.4.dev19.g80c0054-0.7.1 SUSE OpenStack Cloud 4:openstack-cinder-scheduler-2014.1.4.dev19.g80c0054-0.7.1 SUSE OpenStack Cloud 4:openstack-cinder-volume-2014.1.4.dev19.g80c0054-0.7.1 SUSE OpenStack Cloud 4:openstack-nova-2014.1.4.dev49-0.7.1 SUSE OpenStack Cloud 4:openstack-nova-api-2014.1.4.dev49-0.7.1 SUSE OpenStack Cloud 4:openstack-nova-cells-2014.1.4.dev49-0.7.1 SUSE OpenStack Cloud 4:openstack-nova-cert-2014.1.4.dev49-0.7.1 SUSE OpenStack Cloud 4:openstack-nova-compute-2014.1.4.dev49-0.7.1 SUSE OpenStack Cloud 4:openstack-nova-conductor-2014.1.4.dev49-0.7.1 SUSE OpenStack Cloud 4:openstack-nova-console-2014.1.4.dev49-0.7.1 SUSE OpenStack Cloud 4:openstack-nova-consoleauth-2014.1.4.dev49-0.7.1 SUSE OpenStack Cloud 4:openstack-nova-doc-2014.1.4.dev49-0.7.1 SUSE OpenStack Cloud 4:openstack-nova-novncproxy-2014.1.4.dev49-0.7.1 SUSE OpenStack Cloud 4:openstack-nova-objectstore-2014.1.4.dev49-0.7.1 SUSE OpenStack Cloud 4:openstack-nova-scheduler-2014.1.4.dev49-0.7.1 SUSE OpenStack Cloud 4:openstack-nova-vncproxy-2014.1.4.dev49-0.7.1 SUSE OpenStack Cloud 4:python-cinder-2014.1.4.dev19.g80c0054-0.7.1 SUSE OpenStack Cloud 4:python-nova-2014.1.4.dev49-0.7.1 SUSE OpenStack Cloud 6:openstack-cinder-7.0.2~a0~dev1-1.2 SUSE OpenStack Cloud 6:openstack-cinder-api-7.0.2~a0~dev1-1.2 SUSE OpenStack Cloud 6:openstack-cinder-backup-7.0.2~a0~dev1-1.2 SUSE OpenStack Cloud 6:openstack-cinder-scheduler-7.0.2~a0~dev1-1.2 SUSE OpenStack Cloud 6:openstack-cinder-volume-7.0.2~a0~dev1-1.2 SUSE OpenStack Cloud 6:openstack-nova-12.0.2~a0~dev18-1.3 SUSE OpenStack Cloud 6:openstack-nova-api-12.0.2~a0~dev18-1.3 SUSE OpenStack Cloud 6:openstack-nova-cells-12.0.2~a0~dev18-1.3 SUSE OpenStack Cloud 6:openstack-nova-cert-12.0.2~a0~dev18-1.3 SUSE OpenStack Cloud 6:openstack-nova-compute-12.0.2~a0~dev18-1.3 SUSE OpenStack Cloud 6:openstack-nova-conductor-12.0.2~a0~dev18-1.3 SUSE OpenStack Cloud 6:openstack-nova-console-12.0.2~a0~dev18-1.3 SUSE OpenStack Cloud 6:openstack-nova-consoleauth-12.0.2~a0~dev18-1.3 SUSE OpenStack Cloud 6:openstack-nova-novncproxy-12.0.2~a0~dev18-1.3 SUSE OpenStack Cloud 6:openstack-nova-objectstore-12.0.2~a0~dev18-1.3 SUSE OpenStack Cloud 6:openstack-nova-scheduler-12.0.2~a0~dev18-1.3 SUSE OpenStack Cloud 6:openstack-nova-serialproxy-12.0.2~a0~dev18-1.3 SUSE OpenStack Cloud 6:openstack-nova-vncproxy-12.0.2~a0~dev18-1.3 SUSE OpenStack Cloud 6:openstack-trove-4.0.1~a0~dev2-2.1 SUSE OpenStack Cloud 6:openstack-trove-api-4.0.1~a0~dev2-2.1 SUSE OpenStack Cloud 6:openstack-trove-conductor-4.0.1~a0~dev2-2.1 SUSE OpenStack Cloud 6:openstack-trove-guestagent-4.0.1~a0~dev2-2.1 SUSE OpenStack Cloud 6:openstack-trove-taskmanager-4.0.1~a0~dev2-2.1 SUSE OpenStack Cloud 6:python-cinder-7.0.2~a0~dev1-1.2 SUSE OpenStack Cloud 6:python-nova-12.0.2~a0~dev18-1.3 SUSE OpenStack Cloud 6:python-trove-4.0.1~a0~dev2-2.1 low 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N