CVE-2024-1141

Access key is logged when DEBUG level is enabled in python-glance-store.

• CVSS 5.5
• CWE-779
• Information Leakage
• Remote

A vulnerability was found in python-glance-store. The issue occurs when the package logs the access_key for the glance-store when the DEBUG log level is enabled.

CVE

CVE-2024-1141

CWE

CWE-779

CVSS base score

5.5

Published

2024-02-01

OWASP

A03 Sensitive Data Exposure

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Information Leakage

Subcategory

Information Disclosure

Accessibility scope

Remote

Impact

Information Disclosure

Affected component

python-glanc

Fixed by upgrading

Yes

Solution

Upgrade to python-glance-store version 0.10.0 or later to mitigate the logging of access_key at DEBUG log level.

import logging

logging.basicConfig(level=logging.DEBUG)

def access_resource(access_key):
    """Vulnerable function that demonstrates the security issue."""
    logging.debug(f"Accessing resource with access key: {access_key}")
    return f"Resource accessed with key: {access_key}"

access_key = "my_secret_access_key"
access_resource(access_key)

import logging

logging.basicConfig(level=logging.INFO)

def access_resource(access_key):
    """Secure function that fixes the vulnerability."""
    logging.info("Accessing resource with provided access key.")
    return f"Resource accessed with key: {access_key}"

access_key = "my_secret_access_key"
access_resource(access_key)

access_key = "my_secret_access_key"
logging.debug(f"Accessing resource with access key: {access_key}")

@misc{vaitp:cve20241141,
  title        = {{Access key is logged when DEBUG level is enabled in python-glance-store.}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2024},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2024-1141},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2024-1141/}}
}