Skip to content
Fencer Vulns
medium 4.9

CVE-2022-0718 json

python-oslo-utils has improper password parsing

published 2022-08-29 4 y ago modified 2026-06-17 4 mo ago also GHSA-wmqq-r32m-87c5 , PYSEC-2022-258 , EUVD-2022-0189

cvss
4.9
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.9%
EPSS 1.9% chance of exploitation in 30 days, percentile 79%
public exploits
0
none known

Summary

A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.

Patch / fix

  • pypi oslo-utils 4.10.1
  • openstack oslo.utils 4.10.1
  • python-oslo.utils Debian 14, Debian 13, Debian 12 4.10.1-1

debian advisories DEBIAN-CVE-2022-0718

  • python-oslo.utils Ubuntu 18.04 LTS 3.35.0-0ubuntu1.1
  • python-oslo.utils Ubuntu 20.04 LTS 4.1.1-0ubuntu1.1
  • python-oslo.utils Ubuntu Pro 16.04 LTS 3.8.0-2ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2022-0718

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-oslo-utils openstack 16.1 3.41.6-1.20220426095230.f4deaad.el8ost
  • python3-oslo-utils openstack 16.1 3.41.6-1.20220426095230.f4deaad.el8ost
  • python-oslo-utils-lang openstack 16.1 3.41.6-1.20220426095230.f4deaad.el8ost
  • python-oslo-utils openstack 16.2 3.41.6-2.20220111011750.el8ost
  • python3-oslo-utils openstack 16.2 3.41.6-2.20220111011750.el8ost
  • python-oslo-utils-lang openstack 16.2 3.41.6-2.20220111011750.el8ost

red hat advisories RHSA-2022:8873RHSA-2022:0993

  • python-oslo.utils SLE Module for Public Cloud 15 SP7, SLE Module for Public Cloud 15 SP6, SLE Module for Public Cloud 15 SP5 +3 more 4.1.1-150200.8.7.1

suse advisories SUSE-SU-2025:02448-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-0718 updated cvss 6.0

python-oslo-utils: incorrect password masking in debug output

  • Red Hat OpenShift Container Platform 4 python-oslo-utils, python3-oslo-utils, python-oslo-utils-lang, python3-oslo-utils-tests
    affected: no fix available
  • Red Hat OpenStack Platform 13 (Queens) python-oslo-utils, python2-oslo-utils, python-oslo-utils-lang
    affected: no fix planned “Out of support scope”
  • Red Hat Storage 3 python-oslo-utils, python-oslo-utils-lang, python-oslo-utils-tests
    affected: no fix planned “Will not fix”
  • Red Hat OpenStack Platform 16.1 python-oslo-utils 3.41.6-1.20220426095230.f4deaad.el8ost, python3-oslo-utils 3.41.6-1.20220426095230.f4deaad.el8ost, python-oslo-utils-lang 3.41.6-1.20220426095230.f4deaad.el8ost
    fixed: vendor fix RHSA-2022:8873
  • Red Hat OpenStack Platform 16.2 python-oslo-utils 3.41.6-2.20220111011750.el8ost, python3-oslo-utils 3.41.6-2.20220111011750.el8ost, python-oslo-utils-lang 3.41.6-2.20220111011750.el8ost
    fixed: vendor fix RHSA-2022:0993

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.86% chance of exploitation in the next 30 days, higher than 79% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugs.launchpad.net https://bugs.launchpad.net/oslo.utils/+bug/1949623 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
GitHub 3.1 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
pypi oslo-utils
<4.10.1
4.10.1

Affected products

  • n/a openstack/python-oslo.utils

Classification

Weakness
  • CWE-522 Insufficiently Protected Credentials
  • CWE-532 Insertion of Sensitive Information into Log File

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.