Log in Start free

Vulnerability · Published Feb 1, 2024 · Assigned by redhat

CVE-2024-1141Glance-store: glance store access key logged in debug log level

Medium 5.5

In plain English

A medium-severity security flaw in glance-store. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.2%top 86.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in python-glance-store. The issue occurs when the package logs the access_key for the glance-store when the DEBUG log level is enabled.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12python-glance-storeno fix listedDEBIAN-CVE-2024-1141
Debian:13python-glance-store4.7.0-2DEBIAN-CVE-2024-1141
Debian:14python-glance-store4.7.0-2DEBIAN-CVE-2024-1141
PyPIglance-storeno fix listedGHSA-wgpq-p2hm-56v9
PyPIglance-store4.7.0PYSEC-2026-1405
Ubuntu:22.04:LTSpython-glance-store3.0.0-0ubuntu1.4USN-6630-1
Ubuntu:22.04:LTSpython-glance-store3.0.0-0ubuntu1.4UBUNTU-CVE-2024-1141
Ubuntu:24.04:LTSpython-glance-store4.6.1-0ubuntu3UBUNTU-CVE-2024-1141

Affected products (as reported)

VendorProductVersions
glance-store 0 – before 4.7.0
Red Hat Red Hat OpenStack Platform 17.1 for RHEL 9 see references
Red Hat Red Hat OpenStack Platform 16.1 see references
Red Hat Red Hat OpenStack Platform 16.2 see references
Red Hat Red Hat OpenStack Platform 18.0 see references

Weakness: CWE-779 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References