Sensitive Information Exposure in python-glance-store: Access Key Logging Vulnerability
Summary
DEBIAN-CVE-2024-1141: A vulnerability was found in python-glance-store. Affects python-glance-store versions < 4.7.0-2. Fixed in 4.7.0-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-glance-store is a component of the OpenStack ecosystem that provides a storage backend for images. It allows users to store and retrieve images in a variety of formats. The package is designed to be flexible and extensible, supporting multiple storage backends. However, it has been found to log sensitive information, specifically the access_key, when the DEBUG log level is enabled, which poses a security risk.
Vulnerability Detail
A vulnerability exists in python-glance-store where the access_key is logged when the DEBUG log level is enabled. This can lead to unauthorized access if the logs are exposed or accessed by malicious actors. The issue arises from improper handling of sensitive information in the logging mechanism, which can inadvertently disclose credentials and other sensitive data.
How To Fix
Minimum fixed version
4.7.0-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-glance-storeTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable DEBUG logging in your configuration to prevent the access_key from being logged. This can be done by setting the log level to INFO or higher in your logging configuration file.
Conclusion
The python-glance-store package has a vulnerability that exposes sensitive access keys when DEBUG logging is enabled. It is crucial to update to the patched version 4.7.0-2 to mitigate this risk. Additionally, disabling DEBUG logging can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for python-glance-store →
FAQ
The vulnerability can lead to exposure of sensitive access keys, which may allow unauthorized users to gain access to the storage backend.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Yes, a patch is available in version 4.7.0-2 of python-glance-store. Updating to this version will resolve the issue.
If you cannot update immediately, consider disabling DEBUG logging to prevent sensitive information from being logged.
More information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-1141.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-glance-store.
