Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

PyPI package

zhmcclient

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.2PyPIAmendedPublished

    Python package "zhmcclient" stores passwords in clear text in its HMC and API logs

    CVE-2024-53865 · GHSA-p57h-3cmc-xpjq

    Affected
    • PyPI zhmcclient < 1.18.1
    Fixed in
    1.18.1· Vendor fix available
    Issue
    Impact The Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in the following cases: The 'boot-ftp-password' and 'ssc-master-pw' properties when creating or updating a partition in DPM mode, in the zhmcclient API and HMC logs The 'ssc-master-pw' and 'zaware-master-pw' properties when updating an LPAR in classic mode, in the zhmcclient API and HMC logs The 'ssc-master-pw' and 'zaware-master-pw' properties when creating or updating an image activation profile in classic mode, in the zhmcclient API and HMC logs The 'password' property when creating or updating an HMC user, in the zhmcclient API log The 'bind-password' property when creating or updating an LDAP server definition, in the zhmcclient API and HMC logs This issue affects only users of the zhmcclient package that have enabled the Python loggers named "zhmcclient.api" (for the API log) or "zhmcclient.hmc" (for the HMC log) and that use the functions listed above. Patches Has…

    Recommended action: Upgrade to 1.18.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →