A vulnerability was found in ceilometer before version 12.0.0.0rc1. An Information Exposure in ceilometer-agent prints sensitive configuration data to log files without DEBUG logging being activated.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0566 advisory.

    OpenStack Telemetry (ceilometer) collects customer usage data for metering purposes. Telemetry implements     bus listener, push, and polling agents for data collection. This data is stored in a database and     presented via the REST API. In addition, Telemetry's extensible design means it can be optionally extended     to gather customized data sets.

    Security Fix(es):

    * openstack-ceilometer: ceilometer-agent prints sensitive data from config files through log files     (CVE-2019-3830)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0580 advisory.

    OpenStack Telemetry (ceilometer) collects customer usage data for metering purposes. Telemetry implements     bus listener, push, and polling agents for data collection. This data is stored in a database and     presented via the REST API. In addition, Telemetry's extensible design means it can be optionally extended     to gather customized data sets.

    The following packages have been upgraded to a later upstream version: openstack-ceilometer (11.0.2).
    (BZ#1677462)

    Security Fix(es):

    * openstack-ceilometer: ceilometer-agent prints sensitive data from config files through log files     (CVE-2019-3830)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0919 advisory.

    OpenStack Telemetry (ceilometer) collects customer usage data for metering purposes. Telemetry implements     bus listener, push, and polling agents for data collection. This data is stored in a database and     presented via the REST API. In addition, Telemetry's extensible design means it can be optionally extended     to gather customized data sets.

    Security Fix(es):

    * openstack-ceilometer: ceilometer-agent prints sensitive data from config files through log files     (CVE-2019-3830)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194133	RHEL 7 : openstack-ceilometer (RHSA-2019:0566)	Nessus	Red Hat Local Security Checks	high
194123	RHEL 7 : openstack-ceilometer (RHSA-2019:0580)	Nessus	Red Hat Local Security Checks	high
194108	RHEL 7 : openstack-ceilometer (RHSA-2019:0919)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2019-3830

medium

Tenable Plugins

high

high

high