Every CVE Search/ Get API key

CVE-2018-16856

Openstack Octavia allows Insertion of Sensitive Information into Log File

5.5 MediumFix available

In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.89%Up 0.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 5.5

In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure.

Record
CVE-2018-16856
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
EUVDEUVD-2019-0099 5.5

In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure.

Record
EUVD-2019-0099
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-qcj3-h27m-mp9x 8.7

Openstack Octavia allows Insertion of Sensitive Information into Log File

In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure.

Record
GHSA-qcj3-h27m-mp9x
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
NVD 5.5

In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure.

Record
CVE-2018-16856
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
OSVGHSA-qcj3-h27m-mp9x 8.7

Openstack Octavia allows Insertion of Sensitive Information into Log File

In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure.

Record
GHSA-qcj3-h27m-mp9x
CVSS 4.0
8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
OSVRHSA-2019:0567 5.5

Red Hat Security Advisory: openstack-octavia security and bug fix update

Record
RHSA-2019:0567
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2019:0593 5.5

Red Hat Security Advisory: openstack-octavia security update

Record
RHSA-2019:0593
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2018-16856 5.5

In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure.

Record
UBUNTU-CVE-2018-16856
CVSS 3.0
5.5 MediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVPYSEC-2019-193 No score

In a default Red Hat Openstack Platform Director installation, openstack-octavia before versions openstack-octavia 2.0.2-5 and openstack-octavia-3.0.1-0.20181009115732 creates log files that are readable by all users. Sensitive information such as private keys can appear in these log files allowing for information exposure.

Record
PYSEC-2019-193
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
octavia
PyPI
 before 2.1.0
2.1.0
octavia
PyPI
 3.0.0.0b1 up to 3.1.0
3.1.0
octavia
PyPI
 before 2.1.0, plus listed versions
0.10.00.5.20.8.00.8.10.9.0
Show 23 moreShow less
0.9.10.9.21.0.01.0.0.0b11.0.0.0b21.0.0.0b31.0.0.0rc11.0.0.0rc21.0.11.0.21.0.31.0.41.0.52.0.02.0.0.0b12.0.0.0b22.0.0.0b32.0.0.0rc12.0.0.0rc22.0.12.0.22.0.32.0.4
2.1.0
octavia
PyPI
 3.0.0.0b1 up to 3.1.0, plus listed versions
3.0.03.0.0.0b23.0.0.0b33.0.0.0rc13.0.0.0rc23.0.0.0rc33.0.13.0.2
3.1.0
octavia
PyPI
 3.0.0 up to 3.0.2, before 2.0.3, plus listed versions
0.10.00.5.20.8.00.8.10.9.0
Show 22 moreShow less
0.9.10.9.21.0.01.0.0.0b11.0.0.0b21.0.0.0b31.0.0.0rc11.0.0.0rc21.0.11.0.21.0.31.0.41.0.52.0.02.0.0.0b12.0.0.0b22.0.0.0b32.0.0.0rc12.0.0.0rc22.0.12.0.23.0.1
3.0.22.0.3
openstack-octavia
Red Hat:openstack:13::el7
 before 0:2.0.3-2.el7ost
0:2.0.3-2.el7ost
openstack-octavia-amphora-agent
Red Hat:openstack:13::el7
 before 0:2.0.3-2.el7ost
0:2.0.3-2.el7ost
openstack-octavia-api
Red Hat:openstack:13::el7
 before 0:2.0.3-2.el7ost
0:2.0.3-2.el7ost
openstack-octavia-common
Red Hat:openstack:13::el7
 before 0:2.0.3-2.el7ost
0:2.0.3-2.el7ost
openstack-octavia-debuginfo
Red Hat:openstack:13::el7
 before 0:2.0.3-2.el7ost
0:2.0.3-2.el7ost
Show 23 moreShow less
Affected packages
PackageAffectedFixed
openstack-octavia-diskimage-create
Red Hat:openstack:13::el7
 before 0:2.0.3-2.el7ost
0:2.0.3-2.el7ost
openstack-octavia-health-manager
Red Hat:openstack:13::el7
 before 0:2.0.3-2.el7ost
0:2.0.3-2.el7ost
openstack-octavia-housekeeping
Red Hat:openstack:13::el7
 before 0:2.0.3-2.el7ost
0:2.0.3-2.el7ost
openstack-octavia-worker
Red Hat:openstack:13::el7
 before 0:2.0.3-2.el7ost
0:2.0.3-2.el7ost
python-octavia
Red Hat:openstack:13::el7
 before 0:2.0.3-2.el7ost
0:2.0.3-2.el7ost
python-octavia-tests-golang
Red Hat:openstack:13::el7
 before 0:2.0.3-2.el7ost
0:2.0.3-2.el7ost
openstack-octavia
Red Hat:openstack:14::el7
 before 0:3.0.2-0.20181219195054.ec4c88e.el7ost
0:3.0.2-0.20181219195054.ec4c88e.el7ost
openstack-octavia-amphora-agent
Red Hat:openstack:14::el7
 before 0:3.0.2-0.20181219195054.ec4c88e.el7ost
0:3.0.2-0.20181219195054.ec4c88e.el7ost
openstack-octavia-api
Red Hat:openstack:14::el7
 before 0:3.0.2-0.20181219195054.ec4c88e.el7ost
0:3.0.2-0.20181219195054.ec4c88e.el7ost
openstack-octavia-common
Red Hat:openstack:14::el7
 before 0:3.0.2-0.20181219195054.ec4c88e.el7ost
0:3.0.2-0.20181219195054.ec4c88e.el7ost
openstack-octavia-debuginfo
Red Hat:openstack:14::el7
 before 0:3.0.2-0.20181219195054.ec4c88e.el7ost
0:3.0.2-0.20181219195054.ec4c88e.el7ost
openstack-octavia-diskimage-create
Red Hat:openstack:14::el7
 before 0:3.0.2-0.20181219195054.ec4c88e.el7ost
0:3.0.2-0.20181219195054.ec4c88e.el7ost
openstack-octavia-health-manager
Red Hat:openstack:14::el7
 before 0:3.0.2-0.20181219195054.ec4c88e.el7ost
0:3.0.2-0.20181219195054.ec4c88e.el7ost
openstack-octavia-housekeeping
Red Hat:openstack:14::el7
 before 0:3.0.2-0.20181219195054.ec4c88e.el7ost
0:3.0.2-0.20181219195054.ec4c88e.el7ost
openstack-octavia-worker
Red Hat:openstack:14::el7
 before 0:3.0.2-0.20181219195054.ec4c88e.el7ost
0:3.0.2-0.20181219195054.ec4c88e.el7ost
python-octavia
Red Hat:openstack:14::el7
 before 0:3.0.2-0.20181219195054.ec4c88e.el7ost
0:3.0.2-0.20181219195054.ec4c88e.el7ost
python-octavia-tests-golang
Red Hat:openstack:14::el7
 before 0:3.0.2-0.20181219195054.ec4c88e.el7ost
0:3.0.2-0.20181219195054.ec4c88e.el7ost
octavia
Ubuntu:20.04:LTS
 All versions, plus listed versions
5.0.0-0ubuntu16.0.0~b1~git2019121614.45cb1e4e-0ubuntu16.0.0~b2~git2020020614.005cd1e6-0ubuntu16.0.0~b2~git2020020614.005cd1e6-0ubuntu26.0.0~b3~git2020032609.73fca169-0ubuntu1
Show 9 moreShow less
6.0.0~b3~git2020041014.771a5d87-0ubuntu16.0.0-0ubuntu0.20.04.16.0.0-0ubuntu0.20.04.26.1.0-0ubuntu16.2.0-0ubuntu16.2.1-0ubuntu16.2.1-0ubuntu26.2.2-0ubuntu16.2.2-0ubuntu1.1
 None known
octavia
Ubuntu:22.04:LTS
 All versions, plus listed versions
1:9.0.0-0ubuntu11:9.0.0+git2021120816.ab3c3ef7-0ubuntu11:9.0.1+git2022011217.27e5b27d-0ubuntu11:9.0.1+git2022030314.328ffbab-0ubuntu11:10.0.0-0ubuntu1
Show 7 moreShow less
1:10.1.0-0ubuntu11:10.1.1-0ubuntu11:10.1.1-0ubuntu1.11:10.1.1-0ubuntu1.21:10.1.1-0ubuntu1.31:10.1.1-0ubuntu1.41:10.1.1-0ubuntu1.5
 None known
octavia
Ubuntu:24.04:LTS
 All versions, plus listed versions
1:13.0.0-0ubuntu11:13.0.0+git2024011917.5750e451-0ubuntu11:14.0.0~rc1-0ubuntu11:14.0.0-0ubuntu11:14.0.0-0ubuntu1.1
Show 5 moreShow less
1:14.0.0-0ubuntu1.21:14.0.0-0ubuntu1.31:14.0.0-0ubuntu1.41:14.0.0-0ubuntu1.51:14.0.0-0ubuntu1.6
 None known
octavia
Ubuntu:25.10
 All versions, plus listed versions
1:16.0.0-0ubuntu11:16.0.0+git2025070714.0f04d4007-0ubuntu11:17.0.0~rc2-0ubuntu11:17.0.0-0ubuntu11:17.0.0-0ubuntu1.1
 None known
octavia
Ubuntu:26.10
 All versions, plus listed versions
1:18.0.0-0ubuntu21:18.0.0+git20260817.63.0e6ea11-0ubuntu11:19.0.0~rc1-0ubuntu11:19.0.0-0ubuntu1
 None known
octavia
Ubuntu:26.04:LTS
 All versions, plus listed versions
1:17.0.0-0ubuntu11:17.0.0+git20260116.e805a93-0ubuntu11:18.0.0~rc1-0ubuntu21:18.0.0-0ubuntu11:18.0.0-0ubuntu21:18.0.0-0ubuntu2.1
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-16856 is a medium vulnerability (CVSS 5.5) in [unknown] Openstack-octavia, published March 26, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.89%, the 59th percentile. Fixed in octavia 2.1.0.

References

Show 21 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open