The LUKS inspector in oslo.utils can log sensitive cryptographic material when inspecting a LUKSv1 image with a passphrase. When DEBUG logging is enabled for oslo_utils.imageutils._luks, the following sensitive data is logged: part of the PBKDF2-derived key, decrypted LUKS key material, the full LUKS master-key candidate, and computed/expected master-key digests. An attacker with access to these logs and a copy of the encrypted image can recover the plaintext contents by using the logged master-key candidate to decrypt the LUKSv1 image.
| Vendor | Product | Versions |
|---|---|---|
| openstack | oslo.utils | >=10.1.0 <10.3.0 |
Loading…
