Miggo Logo
Miggo Vulnerability Database
→
CVE-2018-16856

CVE-2018-16856: Openstack Octavia allows Insertion of Sensitive Information into Log File

7.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2018-16856
GHSA ID
GHSA-qcj3-h27m-mp9x
EPSS Score
0.49994%
CWE
CWE-532
Published
5/13/2022
Updated
10/7/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
octaviapip< 2.1.02.1.0
octaviapip>= 3.0.0.0b1, < 3.1.03.1.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from taskflow logging sensitive data in debug mode. The commit ae7c87f added Fernet encryption to these functions' certificate handling:

  1. GenerateServerPEMTask previously returned raw cert+key (logged)
  2. AmphoraCertUpload handled raw PEM data (logged during upload)
  3. CertComputeCreate passed raw PEM to VM configuration (logged in task inputs) The removal of _exclude_result_logging_tasks in controller_worker.py indicates prior reliance on exclusion lists rather than encryption. The patched versions encrypt before logging, confirming these were the vulnerable points.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

In * ****ult R** **t Op*nst**k Pl*t*orm *ir**tor inst*ll*tion, op*nst**k-o*t*vi* ***or* v*rsions op*nst**k-o*t*vi* *.*.*-* *n* op*nst**k-o*t*vi*-*.*.*-*.************** *r**t*s lo* *il*s t**t *r* r*****l* *y *ll us*rs. S*nsitiv* in*orm*tion su** *s pr

Reasoning

T** vuln*r**ility st*mm** *rom t*sk*low lo**in* s*nsitiv* **t* in ***u* mo**. T** *ommit ******* ***** **rn*t *n*ryption to t**s* *un*tions' **rti*i**t* **n*lin*: *. **n*r*t*S*rv*rP*MT*sk pr*viously r*turn** r*w **rt+k*y (lo****) *. *mp*or***rtUplo**