Read the docs
TI-2018-12066 Aliases CVE-2018-16856GHSA-qcj3-h27m-mp9x

Sensitive information in log files in [UNKNOWN] openstack-octavia

Priority LOW 34CWE-532Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure.

Why it matters now

EPSS 0.00878 59th percentileScored 2026-11-07
Fix Partial octavia (PyPI): 2.1.0, 3.1.0Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[UNKNOWN]openstack-octavia2.0.2-5; openstack-octavia-3.0.1-0.20181009115732—No fix listedCNA
—octavia (PyPI)before 2.1.02.1.0Patch availableGHSA-qcj3-h27m-mp9x
—octavia (PyPI)3.0.0.0b1 to before 3.1.03.1.0Patch availableGHSA-qcj3-h27m-mp9x
  • openstack-octavia Vendor[UNKNOWN] Affected 2.0.2-5; openstack-octavia-3.0.1-0.20181009115732 Fixed in — No fix listed CNA
  • octavia (PyPI) Vendor— Affected before 2.1.0 Fixed in 2.1.0 Patch available GHSA-qcj3-h27m-mp9x
  • octavia (PyPI) Vendor— Affected 3.0.0.0b1 to before 3.1.0 Fixed in 3.1.0 Patch available GHSA-qcj3-h27m-mp9x

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:openstack:octavia:*:*:*:*:*:*:*:*2.0.0 to before 2.0.2-5; 3.0.0 to before 3.0.1-0.20181009115732VulnerableOpenStack
cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:*12VulnerableRed Hat
cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:*13VulnerableRed Hat
cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:*14VulnerableRed Hat
  • cpe:2.3:a:openstack:octavia:*:*:*:*:*:*:*:* Versions 2.0.0 to before 2.0.2-5; 3.0.0 to before 3.0.1-0.20181009115732 Vulnerable ·OpenStack
  • cpe:2.3:a:redhat:openstack:12:*:*:*:*:*:*:* Versions 12 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:13:*:*:*:*:*:*:* Versions 13 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openstack:14:*:*:*:*:*:*:* Versions 14 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-qcj3-h27m-mp9x octavia (PyPI) Fixed in 2.1.0 Advisory →
  • Fix · GHSA-qcj3-h27m-mp9x octavia (PyPI) Fixed in 3.1.0 Advisory →

Red Hat 2 advisories

  • RHSA-2019:0593 Released 2019-03-18 · Red Hat rating Moderate
    openstack-octavia security update
    • Red Hat OpenStack Platform 14.0 openstack-octavia-3.0.2-0.20181219195054.ec4c88e.el7ost, openstack-octavia-amphora-agent-3.0.2-0.20181219195054.ec4c88e.el7ost, openstack-octavia-api-3.0.2-0.20181219195054.ec4c88e.el7ost +7
  • RHSA-2019:0567 Released 2019-03-14 · Red Hat rating Moderate
    openstack-octavia security and bug fix update
    • Red Hat OpenStack Platform 13.0 openstack-octavia-2.0.3-2.el7ost, openstack-octavia-amphora-agent-2.0.3-2.el7ost, openstack-octavia-api-2.0.3-2.el7ost +7

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenStack Platform 12 (Pike)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 13.0Fixed RHSA-2019:0567
Red Hat OpenStack Platform 14.0Fixed RHSA-2019:0593

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-16856
  2. 2026-10-03 Alias added: GHSA-qcj3-h27m-mp9x

References

Advisory 2

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences