Cyber Resilience

CVE-2022-0718

MediumPublic PoC

Published: 29 August 2022

Published
29 August 2022
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.0142 81.0th percentile
Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-0718 is a medium-severity Insufficiently Protected Credentials (CWE-522) vulnerability in Openstack Oslo.Utils. Its CVSS base score is 4.9 (Medium).

Operationally, ranked in the top 19.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

openstack
oslo.utils
4.12.0 · ≤ 4.10.1
redhat
openshift container platform
4.0
redhat
openstack platform
16.1
debian
debian linux
10.0, 11.0

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-522

Training instructs users on protecting credentials from disclosure or unauthorized access.

addresses: CWE-522

Training records for security awareness and role-based training verify education on credential protection practices, tangibly reducing risks from mishandling or exposing credentials.

addresses: CWE-532

Procedures mandate excluding sensitive data from logs to prevent unauthorized exposure via audit records.

addresses: CWE-532

Identifies insertion of sensitive data into logs, allowing detection of unauthorized disclosure.

addresses: CWE-532

Cross-organizational coordination enables agreement on what data to include in audit logs, directly reducing insertion of sensitive information.

addresses: CWE-532

Identifying logging as a data action allows prevention of sensitive information being inserted into log files.

addresses: CWE-522

Protecting authenticator content from unauthorized disclosure and modification while requiring protective controls addresses insufficiently protected credentials.

addresses: CWE-532

The process of identifying and eradicating spilled information applies directly to sensitive data inserted into log files.

References