What’s Vulnerable › Vulnerabilities

CVE-2014-7231

• Severity: low (CVSS 2.1 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2014-10-08 · updated 2026-06-17
• Weakness: CWE-200

Description

The strutils.mask_password function in the OpenStack Oslo utility library, Cinder, Nova, and Trove before 2013.2.4 and 2014.1 before 2014.1.3 does not properly mask passwords when logging commands, which allows local users to obtain passwords by reading the log.

Affected products

• OpenStack Cinder: from 2013.2 before 2013.2.4; from 2014.1 before 2014.1.3 — fixed in 2013.2.4, 2014.1.3
• OpenStack Nova: from 2013.2 before 2013.2.4; from 2014.1 before 2014.1.3 — fixed in 2013.2.4, 2014.1.3
• OpenStack Trove: from 2013.2 before 2013.2.4; from 2014.1 before 2014.1.3 — fixed in 2013.2.4, 2014.1.3
• OpenStack: 5.0

How to fix

Upgrade to a fixed version: OpenStack Cinder 2013.2.4, 2014.1.3; OpenStack Nova 2013.2.4, 2014.1.3; OpenStack Trove 2013.2.4, 2014.1.3. Check the vendor advisory for mitigations.

References

• http://rhn.redhat.com/errata/RHSA-2014-1939.html
• http://seclists.org/oss-sec/2014/q3/853
• http://www.securityfocus.com/bid/70184
• https://bugs.launchpad.net/oslo.utils/+bug/1345233
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96726
• http://rhn.redhat.com/errata/RHSA-2014-1939.html
• http://seclists.org/oss-sec/2014/q3/853
• http://www.securityfocus.com/bid/70184
• https://bugs.launchpad.net/oslo.utils/+bug/1345233
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96726

Get alerted when CVE-2014-7231 or the next vulnerability affects your stack