Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-0718

CVE-2022-0718: python-oslo-utils has improper password parsing

4.9

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-0718
GHSA ID
GHSA-wmqq-r32m-87c5
EPSS Score
0.52399%
CWE
CWE-522
Published
8/29/2022
Updated
10/8/2024
KEV Status
No
Technology
TechnologyPython

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
oslo-utilspip< 4.10.14.10.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from improper regex handling in the password masking logic. The commit 6e17ae1f7959c64dfd20a5f67edf422e702426aa explicitly modifies the regex patterns and adds new wildcard patterns (_FORMAT_PATTERNS_WILDCARD) in strutils.py to address quote handling. Test cases in test_strutils.py demonstrate scenarios where passwords with quotes were previously partially exposed. The mask_password function is directly responsible for credential obfuscation in logs, making it the clear vulnerable component.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* *l*w w*s *oun* in pyt*on-oslo-utils. *u* to improp*r p*rsin*, p*sswor*s wit* * *ou*l* quot* ( " ) in t**m **us* in*orr**t m*skin* in ***u* lo*s, **usin* *ny p*rt o* t** p*sswor* **t*r t** *ou*l* quot* to ** pl*int*xt

Reasoning

T** vuln*r**ility st*mm** *rom improp*r r***x **n*lin* in t** p*sswor* m*skin* lo*i*. T** *ommit **************************************** *xpli*itly mo*i*i*s t** r***x p*tt*rns *n* ***s n*w wil***r* p*tt*rns (_*ORM*T_P*TT*RNS_WIL***R*) in strutils.py