CVE-2021-3585

low-risk
Published 2022-08-26

A flaw was found in openstack-tripleo-heat-templates. Plain passwords from RHSM exist in the logs during OSP13 deployment with subscription-manager.

Do I need to act?

-
0.03% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
5
CVSS 5.5/10 Medium
LOCAL / LOW complexity

Affected Products (1)

Tripleo Heat Templates

Affected Vendors

Openstack

References (10)

Third Party Advisory https://access.redhat.com/security/cve/CVE-2021-3585
Exploit https://bugs.launchpad.net/tripleo/+bug/1931132
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1961709
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1968247
Patch https://review.opendev.org/c/openstack/tripleo-heat-templates/+/791988
Third Party Advisory https://access.redhat.com/security/cve/CVE-2021-3585
Exploit https://bugs.launchpad.net/tripleo/+bug/1931132
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1961709
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1968247
Patch https://review.opendev.org/c/openstack/tripleo-heat-templates/+/791988
23
/ 100
low-risk
Severity 18/34 · Moderate
Exploitability 0/34 · Minimal
Exposure 5/34 · Minimal