Sensu, Inc. Sensu Core version Before 1.2.0 & before commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b contains a CWE-522 vulnerability in Sensu::Utilities.redact_sensitive() that can result in sensitive configuration data (e.g. passwords) may be logged in clear-text. This attack appear to be exploitable via victims with configuration matching a specific pattern will observe sensitive data outputted in their service log files. This vulnerability appears to have been fixed in 1.2.1 and later, after commit 46ff10023e8cbf1b6978838f47c51b20b98fe30b.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1112 advisory.

    Sensu is a monitoring framework that aims to be simple, malleable, and scalable.

    Security Fix(es):

    * Sensu's redaction function fails to handle the redaction of sensitive data in deeply nested data     structures, resulting in sensitive data, such as passwords, being logged in clear-text. (CVE-2018-1000060)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Debashis Pradhan (Huawei Technologies) for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:0616 advisory.

    Sensu is a monitoring framework that aims to be simple, malleable, and scalable.

    Security Fix(es):

    * sensu: Password exposure in warn level log when configured for multiple rabbitMQ connections     (CVE-2018-1000060)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Red Hat would like to thank Debashis Pradhan (Huawei Technologies) for reporting this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2018:1606 advisory.

    Sensu is a monitoring framework that aims to be simple, malleable, and     scalable.

    Security fix(es):

    * Sensu's redaction function fails to handle the redaction of sensitive data in deeply nested data     structures, resulting in sensitive data, such as passwords, being logged in clear-text. (CVE-2018-1000060)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194126	RHEL 7 : sensu (RHSA-2018:1112)	Nessus	Red Hat Local Security Checks	critical
194076	RHEL 7 : sensu (RHSA-2018:0616)	Nessus	Red Hat Local Security Checks	critical
194010	RHEL 7 : sensu (RHSA-2018:1606)	Nessus	Red Hat Local Security Checks	critical

Detections

Analytics

CVE-2018-1000060

critical

Tenable Plugins

critical

critical

critical