CVE-2019-3830: Ceilometer Prints Sensitive Configuration Data to Log
(updated )
A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.
References
- access.redhat.com/errata/RHSA-2019:0919
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3830
- github.com/advisories/GHSA-2cvf-r9jm-4qm9
- github.com/openstack/ceilometer
- github.com/openstack/ceilometer/commit/8881a42af169a2d7c912b1434911f978883c83f3
- github.com/openstack/ceilometer/commit/8881a42af169a2d7c912b1434911f978883c83f3
- github.com/pypa/advisory-database/tree/main/vulns/ceilometer/PYSEC-2019-78.yaml
- nvd.nist.gov/vuln/detail/CVE-2019-3830
Code Behaviors & Features
Detect and mitigate CVE-2019-3830 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →