Executive brief
OpenStack Ceilometer is an OpenStack component that monitors and meters cloud infrastructure. A flaw in the ceilometer-agent component causes sensitive configuration data—such as authentication credentials for target resources—to be written to application logs at normal INFO level. An operator reviewing logs for debugging or monitoring purposes could inadvertently expose credentials without enabling DEBUG logging.
Technical details
The vulnerability is an information exposure (CWE-532) in ceilometer-agent where configuration file contents are logged at INFO level instead of DEBUG level. The polling.yaml configuration file can contain sensitive credentials (e.g., SNMP admin credentials) for monitored resources. Because many operators run applications with INFO-level logging enabled for operational visibility, this data was exposed in log files accessible to system administrators and log aggregation systems. The fix changes the log level from INFO to DEBUG, ensuring this data is only logged when explicitly requested for troubleshooting. No authentication or network access is required to exploit this; any administrator with log file access can retrieve the exposed credentials.
Affected products
- OpenStack Ceilometer before 12.0.0.0rc1
Timeline
- 2019-03-26: disclosed: CVE-2019-3830 published
- 2019-03-26: patched: Commit 8881a42 fixes the vulnerability by changing log level from INFO to DEBUG