{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/oslo.utils/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["oslo.utils"],"_cs_severities":["medium"],"_cs_tags":["openstack","information-exposure","log-security"],"_cs_type":"advisory","_cs_vendors":["OpenStack"],"content_html":"\u003cp\u003eThe oslo.utils library, a common utility component in OpenStack, contains a security flaw in its LUKS inspector functionality. When the library processes a LUKSv1 image protected by a passphrase, it may inadvertently log the cryptographic key material to system logs. This exposure provides sufficient data for an unauthorized actor with access to log files to decrypt the affected disk images.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe primary impact is the unauthorized exposure of disk encryption keys in system logs. This allows for potential full data decryption of LUKSv1 volumes if logs are intercepted or improperly secured.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eAudit system and application log repositories for the presence of cryptographic material or unexpected debugging output from oslo.utils.\u003c/li\u003e\n\u003cli\u003eReview OpenStack or service-specific security advisories for patches addressing this library.\u003c/li\u003e\n\u003cli\u003eApply restricted access controls to log aggregation platforms to prevent unauthorized access to potentially sensitive log entries.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-22T19:57:20Z","date_published":"2026-10-22T19:57:20Z","id":"https://feed.craftedsignal.io/briefs/2026-10-oslo-utils-luks-leak/","summary":"The oslo.utils library contains an information exposure vulnerability in its LUKS inspector that can result in sensitive cryptographic key material being written to system logs when processing LUKSv1 disk images.","title":"OpenStack oslo.utils: Information exposure of LUKS key material","url":"https://feed.craftedsignal.io/briefs/2026-10-oslo-utils-luks-leak/"}],"language":"en","title":"CraftedSignal Threat Feed - Oslo.utils","version":"https://jsonfeed.org/version/1.1"}