Ceilometer Prints Sensitive Configuration Data to Log

HIGH 7.8CVE-2019-3830 · GHSA-2cvf-r9jm-4qm9 · PYSEC-2019-78 · Published 26/03/2019 · updated 17/06/2026

Package	Affected versions	Patched versions
ceilometer PyPI	`< 12.0.0.0rc1`	`12.0.0.0rc1`
ceilometer openstack	`≥ 2013.1, ≤ 2015.1.4≤ 11.01`	No fix yet
openstack redhat	`= 10`	No fix yet

Description

A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.

NVD description

A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.

References

nvd.nist.gov/vuln/detail/CVE-2019-3830 · ADVISORY
openstack/ceilometer commit 8881a42 · WEB
openstack/ceilometer commit 8881a42 · WEB
access.redhat.com/errata/RHSA-2019:0919 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
openstack/ceilometer · PACKAGE
pypa/advisory-database · WEB
GitHub Advisory GHSA-2cvf-r9jm-4qm9 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free