{"id":"CVE-2019-3866","aliases":["DEBIAN-CVE-2019-3866","EUVD-2019-13480","GHSA-237x-6c63-mfj6","RHEA-2020:0283","UBUNTU-CVE-2019-3866","USN-7465-1"],"status":"published","title":"An information-exposure vulnerability was discovered where openstack-mistral's undercloud log...","description":"An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information.","severity":{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00339,"percentile":0.27488,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-732"],"published":"2019-11-08T14:45:58Z","modified":"2026-10-06T06:00:05Z","fixes":[{"ecosystem":"Debian:12","package":"mistral","fixed_in":["5.1.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mistral","fixed_in":["5.1.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mistral","fixed_in":["5.1.0-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-mistral-lib","fixed_in":["1.2.0-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-mistral-lib","fixed_in":["1.2.0-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-mistral-lib","fixed_in":["1.2.0-3"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-oslo.utils","fixed_in":["3.41.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-oslo.utils","fixed_in":["3.41.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-oslo.utils","fixed_in":["3.41.3-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-mistral-lib","fixed_in":["0.4.0-0ubuntu1+esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mistral","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mistral","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mistral","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.1.0-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-mistral-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-mistral-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-mistral-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-oslo.utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.41.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-oslo.utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.41.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-oslo.utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.41.3-1"}]}]},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-mistral","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-0.20191125120837.6651519.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-mistral-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-0.20191125120837.6651519.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-mistral-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-0.20191125120837.6651519.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-mistral-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-0.20191125120837.6651519.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-mistral-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-0.20191125120837.6651519.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-mistral-event-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-0.20191125120837.6651519.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-mistral-executor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-0.20191125120837.6651519.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-mistral-notifier","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-0.20191125120837.6651519.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"python3-mistral","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:9.0.2-0.20191125120837.6651519.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.0.1-0.20191210095025.bd3f637.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16::el8","package":"python3-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:16.0.1-0.20191210095025.bd3f637.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-mistral-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-0ubuntu1+esm1"}]}],"versions":["0.2.0-0ubuntu2","0.3.2-0ubuntu1","0.3.3-0ubuntu1","0.4.0-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"mistral","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0-1ubuntu2+esm1"}]}],"versions":["1.0.0-1","1.0.0-4","2.0.0~b3-3","2.0.0~rc1-1","2.0.0~rc2-1","2.0.0-1","2.0.0-1ubuntu2"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"mistral","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.0-0ubuntu1.1+esm1"}]}],"versions":["5.0.0-0ubuntu1","6.0.0~b1-0ubuntu1","6.0.0~b1-0ubuntu2","6.0.0~b2-0ubuntu1","6.0.0~rc1-0ubuntu1","6.0.0-0ubuntu1","6.0.0-0ubuntu1.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-mistral-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0-0ubuntu1+esm1"}]}],"versions":["0.2.0-0ubuntu2","0.3.2-0ubuntu1","0.3.3-0ubuntu1","0.4.0-0ubuntu1"],"bundled":3}],"products":[{"vendor":"[unknown]","product":"openstack-mistral"},{"vendor":"redhat","product":"openstack-mistral"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3866","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3866","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-237x-6c63-mfj6"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-3866","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHEA-2020:0283","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_openstack_platform/16.0/html/release_notes/chap-technical_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1184786","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1222414","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301025","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1328124","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1339540","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1360970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1375207","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481814","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1518222","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1544441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1544822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1545700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1545855","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1565012","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1575079","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1593057","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1596368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1600967","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1601926","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1613455","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1621701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1622233","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1623152","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1623685","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1625244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1625281","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1628541","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1631508","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1636634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1646397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1647005","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1649264","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1663446","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1666973","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1678521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1689816","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1691025","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1693821","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1693838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1695105","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1698021","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1698577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1700396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1702048","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1703091","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1703956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1706896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1708168","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1708191","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1708330","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710089","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710659","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1710947","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1712561","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1716335","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1717359","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1717706","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1718380","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1719185","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1720675","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1722593","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1722890","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723451","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1724167","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1724565","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1725082","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1726230","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1726615","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1727158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1727229","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1728402","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1730230","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1730233","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1733257","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734301","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1735551","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1737366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1737578","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1738447","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1738830","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1739111","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1739479","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1740158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1743569","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1744855","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1745010","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1746068","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1747426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1747931","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1749382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1751718","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1753262","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1754416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1754560","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1754984","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1757979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1758174","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1758302","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1758688","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1759476","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1760410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1760502","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1761356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1762303","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1764240","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1764508","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1765910","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1766494","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767481","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767489","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767894","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768673","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768777","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768910","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1769872","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1770907","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1771807","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1772025","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1772566","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1774581","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775575","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775731","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1776779","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1776931","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1777020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1777263","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1777368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1777529","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1777780","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1777898","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1778822","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1779165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1779221","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1779277","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1779356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1779503","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1780048","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1780103","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1780266","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1780267","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1780913","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1781265","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1781363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1782406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1782594","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1782867","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1782961","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1783299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1784160","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1784665","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1785692","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1785773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1785776","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1786465","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1787406","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788234","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788575","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788577","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788633","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1789163","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1790467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1790555","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1791364","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1791928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1793690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1793960","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1793963","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1795537","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhea-2020_0283.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3866","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768731","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3866","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-19687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1781470","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19687","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19687","tags":["advisory"]},{"url":"https://seclists.org/oss-sec/2019/q4/152","tags":["article"]},{"url":"https://security.openstack.org/ossa/OSSA-2019-006.html","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2019-3866","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7465-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-16848","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16849","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-3866","description":"An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information.","status":"published","published":"2019-11-08T14:45:58Z","modified":"2024-08-04T19:19:18.586Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:20:23.048861Z"}],"euvd":[{"id":"EUVD-2019-13480","description":"An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information.","status":"published","published":"2019-11-08T14:45:58Z","modified":"2024-08-04T19:19:18Z","cvss":[{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T03:06:54.939848Z"}],"ghsa":[{"id":"GHSA-237x-6c63-mfj6","title":"An information-exposure vulnerability was discovered where openstack-mistral's undercloud log...","description":"An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information.","status":"published","published":"2022-05-24T17:00:40Z","modified":"2023-01-28T05:07:51Z","cwes":["CWE-732"],"updated_at":"2026-11-02T14:44:34.529278Z"}],"nvd":[{"id":"CVE-2019-3866","description":"An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information.","status":"published","published":"2019-11-08T15:15:11.843Z","modified":"2026-06-17T02:35:45.94Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:05:35.052973Z"}],"osv":[{"id":"CVE-2019-3866","description":"An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information.","status":"published","published":"2019-11-08T15:15:11.843Z","modified":"2026-03-14T09:37:12.002417Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"DEBIAN-CVE-2019-3866","description":"An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information.","status":"published","published":"2019-11-08T15:15:11.843Z","modified":"2026-10-06T06:00:05.057369128Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"RHEA-2020:0283","title":"Red Hat Enhancement Advisory: Red Hat OpenStack Platform 16.0 GA","status":"published","published":"2024-09-16T03:17:16Z","modified":"2026-08-01T10:03:00Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"UBUNTU-CVE-2019-3866","description":"An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information.","status":"published","published":"2019-11-08T15:15:00Z","modified":"2026-02-04T03:56:42.046431Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.0","score":5.9,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"USN-7465-1","title":"mistral, python-mistral-lib vulnerabilities","description":"It was discovered that Mistral incorrectly handled nested anchors in YAML\nfiles. An attacker could possibly use this issue to cause a denial of\nservice. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-16848)\n\nPierre Gaxatte discovered that Mistral incorrectly handled erroneous SSH\nprivate key filename commands. An attacker could possibly use this issue to\nexpose sensitive information. (CVE-2018-16849)\n\nIt was discovered that Mistral incorrectly handled the permissions of\nsensitive log files. An attacker could possibly use this issue to expose\nsensitive information. This issue only affected Ubuntu 18.04 LTS.\n(CVE-2019-3866)\n","status":"published","published":"2025-04-28T12:07:52Z","modified":"2026-06-25T13:32:30.360365632Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}