python-zhmcclient up to 1.18.0 HMC Web Service API cleartext storage

Summaryinfo

A vulnerability was found in python-zhmcclient up to 1.18.0. It has been declared as problematic. This vulnerability affects unknown code of the component HMC Web Service API. Executing a manipulation can lead to cleartext storage. This vulnerability is tracked as CVE-2024-53865. The attack is restricted to local execution. No exploit exists. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in python-zhmcclient up to 1.18.0. It has been declared as problematic. This vulnerability affects some unknown processing of the component HMC Web Service API. The manipulation with an unknown input leads to a cleartext storage vulnerability. The CWE definition for the vulnerability is CWE-312. The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. As an impact it is known to affect confidentiality. CVE summarizes:

zhmcclient is a pure Python client library for the IBM Z HMC Web Services API. In affected versions the Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: 1. The 'boot-ftp-password' and 'ssc-master-pw' properties when creating or updating a partition in DPM mode, in the zhmcclient API and HMC logs. 2. The 'ssc-master-pw' and 'zaware-master-pw' properties when updating an LPAR in classic mode, in the zhmcclient API and HMC logs. 3. The 'ssc-master-pw' and 'zaware-master-pw' properties when creating or updating an image activation profile in classic mode, in the zhmcclient API and HMC logs. 4. The 'password' property when creating or updating an HMC user, in the zhmcclient API log. 5. The 'bind-password' property when creating or updating an LDAP server definition, in the zhmcclient API and HMC logs. This issue affects only users of the zhmcclient package that have enabled the Python loggers named "zhmcclient.api" (for the API log) or "zhmcclient.hmc" (for the HMC log) and that use the functions listed above. This issue has been fixed in zhmcclient version 1.18.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-53865 since 11/22/2024. The exploitation appears to be easy. The attack needs to be approached locally. Additional levels of successful authentication are required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1555.

Upgrading to version 1.18.1 eliminates this vulnerability. Applying the patch ad32781e782d0f604c6da4680fce48e4cc1f4433 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Programming Language Software

Name

• python-zhmcclient

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17
• 1.18.0

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion