CVE-2022-0718
python-oslo-utils has improper password parsing
A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.
- Record
CVE-2022-0718- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-522, CWE-532
- Updated
- 2026-11-02
CVE List No score
A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.
- Record
CVE-2022-0718- Weakness
- CWE-522
- Updated
- 2026-11-02
EUVDEUVD-2022-0189 No score
A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.
- Record
EUVD-2022-0189- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wmqq-r32m-87c5
python-oslo-utils has improper password parsing
A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext
- Record
GHSA-wmqq-r32m-87c5- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-522, CWE-532
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-0718
A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.
- Record
DEBIAN-CVE-2022-0718- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-03
OSVGHSA-wmqq-r32m-87c5
python-oslo-utils has improper password parsing
A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext
- Record
GHSA-wmqq-r32m-87c5- CVSS 4.0
- 6.9 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-522, CWE-532
- Updated
- 2026-11-02
Show 8 moreShow less
OSVRHSA-2022:0993
Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (python-oslo-utils) security update
- Record
RHSA-2022:0993- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2022:8873
Red Hat Security Advisory: Red Hat OpenStack Platform 16.1.9 (python-oslo-utils) security update
- Record
RHSA-2022:8873- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-0718
A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.
- Record
UBUNTU-CVE-2022-0718- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSV No score
A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.
- Record
CVE-2022-0718- Weakness
- CWE-522
- Updated
- 2026-11-02
OSVMGASA-2022-0189 No score
Updated python-oslo-utils packages fix security vulnerability
oslo.utils could be made to expose sensitive information if it received a specially crafted input (CVE-2022-0718)
- Record
MGASA-2022-0189- Updated
- 2026-11-02
OSVPYSEC-2022-258 No score
A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.
- Record
PYSEC-2022-258- Updated
- 2026-11-02
OSVSUSE-SU-2025:02448-1 No score
Security update for python-oslo.utils
This update for python-oslo.utils fixes the following issues:
- CVE-2022-0718: Fixed incorrect password masking in debug output. (bsc#1196454)
- Record
SUSE-SU-2025:02448-1- Updated
- 2026-11-02
OSVUSN-5369-1 No score
python-oslo.utils vulnerability
It was discovered that oslo.utils incorrectly handled certain inputs. An attacker could possibly use this issue to expose sensitive information.
- Record
USN-5369-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
oslo-utilsPyPI |
before 4.10.1 | 4.10.1 |
python-oslo.utilsDebian:12 |
before 4.10.1-1 | 4.10.1-1 |
python-oslo.utilsDebian:13 |
before 4.10.1-1 | 4.10.1-1 |
python-oslo.utilsDebian:14 |
before 4.10.1-1 | 4.10.1-1 |
python-oslo.utilsDebian:10 |
before 3.36.5-0+deb10u2, plus listed versions 3.36.4-23.36.5-0+deb10u1 |
3.36.5-0+deb10u2 |
python-oslo.utilsDebian:11 |
before 4.6.1-0+deb11u1, plus listed versions 4.6.0-2 |
4.6.1-0+deb11u1 |
oslo-utilsPyPI |
before 4.10.1, plus listed versions 0.1.00.1.10.2.00.3.01.0.0 Show 45 moreShow less1.1.01.1.11.2.01.2.11.3.01.4.01.4.11.4.21.5.01.6.01.7.01.8.01.9.02.0.02.1.02.2.02.3.02.4.02.5.02.6.02.7.02.8.03.0.03.1.03.10.03.11.03.12.03.13.03.14.03.15.03.16.03.16.13.17.03.18.03.19.03.2.03.20.03.21.03.22.03.22.13.22.23.22.33.23.03.24.03.25.0 |
4.10.1 |
python-oslo-utilsMageia:8 |
before 4.12.1-2.mga8 | 4.12.1-2.mga8 |
python-oslo-utilsRed Hat:openstack:16.2::el8 |
before 0:3.41.6-2.20220111011750.el8ost | 0:3.41.6-2.20220111011750.el8ost |
python-oslo-utils-langRed Hat:openstack:16.2::el8 |
before 0:3.41.6-2.20220111011750.el8ost | 0:3.41.6-2.20220111011750.el8ost |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python3-oslo-utilsRed Hat:openstack:16.2::el8 |
before 0:3.41.6-2.20220111011750.el8ost | 0:3.41.6-2.20220111011750.el8ost |
python-oslo-utilsRed Hat:openstack:16.1::el8 |
before 0:3.41.6-1.20220426095230.f4deaad.el8ost | 0:3.41.6-1.20220426095230.f4deaad.el8ost |
python-oslo-utils-langRed Hat:openstack:16.1::el8 |
before 0:3.41.6-1.20220426095230.f4deaad.el8ost | 0:3.41.6-1.20220426095230.f4deaad.el8ost |
python3-oslo-utilsRed Hat:openstack:16.1::el8 |
before 0:3.41.6-1.20220426095230.f4deaad.el8ost | 0:3.41.6-1.20220426095230.f4deaad.el8ost |
python-oslo.utilsSUSE:Linux Enterprise Module for Public Cloud 15 SP3 |
before 4.1.1-150200.8.7.1 | 4.1.1-150200.8.7.1 |
python-oslo.utilsSUSE:Linux Enterprise Module for Public Cloud 15 SP4 |
before 4.1.1-150200.8.7.1 | 4.1.1-150200.8.7.1 |
python-oslo.utilsSUSE:Linux Enterprise Module for Public Cloud 15 SP5 |
before 4.1.1-150200.8.7.1 | 4.1.1-150200.8.7.1 |
python-oslo.utilsSUSE:Linux Enterprise Module for Public Cloud 15 SP6 |
before 4.1.1-150200.8.7.1 | 4.1.1-150200.8.7.1 |
python-oslo.utilsSUSE:Linux Enterprise Module for Public Cloud 15 SP7 |
before 4.1.1-150200.8.7.1 | 4.1.1-150200.8.7.1 |
python-oslo.utilsopenSUSE:Leap 15.6 |
before 4.1.1-150200.8.7.1 | 4.1.1-150200.8.7.1 |
python-oslo.utilsUbuntu:Pro:16.04:LTS |
before 3.8.0-2ubuntu0.1~esm1, plus listed versions 2.5.0-1ubuntu13.0.0-1ubuntu13.4.0-1ubuntu13.7.0-0ubuntu13.7.0-13.8.0-2 |
3.8.0-2ubuntu0.1~esm1 |
python-oslo.utilsUbuntu:18.04:LTS |
before 3.35.0-0ubuntu1.1, plus listed versions 3.28.0-0ubuntu13.31.0-0ubuntu13.32.0-0ubuntu13.33.0-0ubuntu13.35.0-0ubuntu1 |
3.35.0-0ubuntu1.1 |
python-oslo.utilsUbuntu:20.04:LTS |
before 4.1.1-0ubuntu1.1, plus listed versions 3.41.1-0ubuntu13.41.1-0ubuntu23.42.1-0ubuntu14.0.0-0ubuntu14.1.1-0ubuntu1 |
4.1.1-0ubuntu1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-0718 is a medium vulnerability (CVSS 4.9) in Debian Linux, published March 23, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.86%, the 79th percentile. Fixed in oslo-utils 4.10.1.
References
bugzilla.redhat.com/show_bug.cgi?id=2056850
bugs.launchpad.net/oslo.utils/+bug/1949623
opendev.org/openstack/oslo.utils/commit/6e17ae1f7959c64dfd20a5f67edf422e702426aa
security-tracker.debian.org/tracker/CVE-2022-0718
access.redhat.com/security/cve/CVE-2022-0718
lists.debian.org/debian-lts-announce/2022/09/msg00015.html
Show 18 moreShow less
nvd.nist.gov/vuln/detail/CVE-2022-0718
github.com/pypa/advisory-database/tree/main/vulns/oslo-utils/PYSEC-2022-258.yaml
advisories.mageia.org/MGASA-2022-0189.html
bugs.mageia.org/show_bug.cgi?id=30254
ubuntu.com/security/notices/USN-5369-1
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0993.json
cve.org/CVERecord?id=CVE-2022-0718
suse.com/support/update/announcement/2025/suse-su-202502448-1
bugzilla.suse.com/1196454
Left out here: 72 versions. The JSON record has them.