OpenStack Nova logs sensitive context from notification exceptions

CRITICAL 9.8CVE-2017-7214 · GHSA-f4g4-cj8f-3cr9 · PYSEC-2026-432 · Published 21/03/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
nova PyPI	`≥ 13.0.0, < 13.1.4≥ 14.0.0, < 14.0.5≥ 15.0.1, < 15.0.2`	`13.1.414.0.515.0.2`
nova openstack	`= 13.0.0= 13.1.0= 13.1.1= 13.1.2= 13.1.3= 14.0.0= 14.0.1= 14.0.2= 14.0.3= 14.0.4= 15.0.0= 15.0.1`	No fix yet

Description

An issue was discovered in exception_wrapper.py in OpenStack Nova 13.x through 13.1.3, 14.x through 14.0.4, and 15.x through 15.0.1. Legacy notification exception contexts appearing in ERROR level logs may include sensitive information such as account passwords and authorization tokens.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2017-7214 · ADVISORY
openstack/nova commit 3f985f1 · WEB
openstack/nova commit acb1916 · WEB
openstack/nova commit c2c91ce · WEB
openstack/nova commit e193201 · WEB
access.redhat.com/errata/RHSA-2017:1508 · WEB
access.redhat.com/errata/RHSA-2017:1595 · WEB
openstack/nova · PACKAGE
launchpad.net/bugs/1673569 · WEB
securityfocus.com/bid/96998 · WEB
pypi.org/project/nova · PACKAGE
GitHub Advisory GHSA-f4g4-cj8f-3cr9 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

nova

PyPI

≥ 13.0.0, < 13.1.4≥ 14.0.0, < 14.0.5≥ 15.0.1, < 15.0.2

13.1.414.0.515.0.2

nova

openstack

= 13.0.0= 13.1.0= 13.1.1= 13.1.2= 13.1.3= 14.0.0= 14.0.1= 14.0.2= 14.0.3= 14.0.4= 15.0.0= 15.0.1

No fix yet

Description

NVD description