CVE-2024-1141
Medium · 5.5CVSS
5.5
EPSS
0.2%
Published
Feb 1, 2024
CISA due date
—
Cloudanix analysis
Debug logging in an OpenStack component can accidentally record secret keys used to access storage, so anyone who reads those logs could gain the ability to reach the stored data.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Low
- Impact
- Data Exposure
- Component
- Library
- Class
- Credential Exposure
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
When DEBUG logging is enabled, the glance-store component writes the configured access_key directly into log output, exposing credential material to any process or user with log access.
Why it matters to the business
Storage or cloud credentials can leak through routine log files, allowing unauthorized parties to access object stores or cloud resources and potentially leading to data exposure or unexpected usage charges.
How an attack unfolds
An attacker first obtains read access to glance-store log files (via compromised host, log aggregation system, or misconfigured permissions). With DEBUG level active, the access_key appears in plaintext within those logs and can be harvested for direct use against the backend storage service.
How to fix it
Disable DEBUG logging for glance-store in production configurations. Monitor upstream OpenStack releases for a corrected package and apply it once available. Restrict log file permissions to the minimum required accounts.
How to confirm the fix worked
Review glance-store configuration to confirm logging level is not set to DEBUG, then inspect recent log files for any occurrence of the literal string access_key or credential values.
Typical attack path
- Enable or confirm DEBUG logging for glance-store
- Obtain access to the resulting log files or log aggregation platform
- Search logs for access_key values
- Use captured credentials to authenticate to the configured storage backend
How to detect it
Search centralized logging systems and glance-store log files for the presence of access_key strings or credential-like values appearing at DEBUG log level; also review any historical log archives that coincide with periods when DEBUG logging was active.
- access_key=
- DEBUG.*glance_store.*access_key
- glance_store.*key.*DEBUG
What your security team should do
- Immediately set glance-store logging to INFO or higher in all production deployments
- Audit log retention and access controls for any systems running glance-store
- Track OpenStack glance-store updates and schedule upgrade as soon as a fixed release is published
The record
A vulnerability was found in python-glance-store. The issue occurs when the package logs the access_key for the glance-store when the DEBUG log level is enabled.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | glance-store | 0 | No fix |
| Debian:11 | python-glance-store | 0 | No fix |
| Debian:12 | python-glance-store | 0 | No fix |
| Debian:13 | python-glance-store | 0 | 4.7.0-2 |
| Red Hat:openstack:17.1::el9 | python-glance-store | 0 | 0:2.5.1-17.1.20230621023901.el9ost |
| Red Hat:openstack:17.1::el9 | python3-glance-store | 0 | 0:2.5.1-17.1.20230621023901.el9ost |
| Ubuntu:16.04:LTS | python-glance-store | 0 | No fix |
| Ubuntu:18.04:LTS | python-glance-store | 0 | No fix |
| Ubuntu:20.04:LTS | python-glance-store | 0 | 2.0.0-0ubuntu4.3 |
| Ubuntu:22.04:LTS | python-glance-store | 0 | 3.0.0-0ubuntu1.4 |
| Ubuntu:23.10 | python-glance-store | 0 | 4.6.1-0ubuntu1.1 |
| Ubuntu:24.04:LTS | python-glance-store | 0 | 4.6.1-0ubuntu3 |
| Ubuntu:Pro:16.04:LTS | python-glance-store | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | python-glance-store | 0 | No fix |