EGI SVG Advisories


Title:   EGI SVG 'ADVISORY' [TLP:WHITE] MODERATE risk - Disk Pool Manager (DPM)
         logging may contain sensitive information [EGI-SVG-2020-16835]

Date:    2020-09-03

Affected software and risk

'MODERATE' risk vulnerability concerning Disk Pool manager (DPM) [R 1] logging

Package : DPM

It has been found that DPM may write highly sensitive information into log
files, including passwords, at higher LogLevel values which normally are used
for debugging purposes only.

Actions required/recommended

Sites which run DPM should check their logging level, see [R 2] and ensure that
for routine operations the LogLevel is set to 1 or 0.  Such logs will not
contain sensitive information.

If sites are running at a higher LogLevel (e.g. for debugging purposes) they
should take extra care of these logs, in particular if they need to share them
for some reason, e.g. with DPM experts. Do not send such logs to mailing lists
and do not attach them to GGUS tickets, unless all sensitive information has
first been removed.

Sites will normally wish to run their DPM logging at no higher than LogLevel 1
anyway, as higher levels tend to use a lot of disk space and may lower the

More information

Future DPM versions may exclude highly sensitive information at all LogLevel


** WHITE information - Unlimited distribution
- see for distribution restrictions **


Minor updates may be made without re-distribution to the sites


Comments or questions should be sent to svg-rat  at

If you find or become aware of another vulnerability which is relevant to EGI
you may report it by e-mail to

report-vulnerability at

the EGI Software Vulnerability Group will take a look according to the
procedure defined in [R 3]

Note that this is undergoing revision to fully handle vulnerabilities in the
EOSC-hub era.


[R 1]

[R 2]

[R 3]


This vulnerability was reported by Robert Currie

Yyyy-mm-dd  [EGI-SVG-2020-16835]

2020-08-24 Vulnerability reported by Robert Currie
2020-08-24 Acknowledgement from the EGI SVG to the reporter
2020-08-24 Software providers responded and involved in investigation
2020-08-25 Investigation of vulnerability and relevance to EGI carried out.
2020-08-26 EGI SVG Risk Assessment completed
2020-08-26 Assessment by the EGI Software Vulnerability Group reported to the
           software providers
2020-09-03 Advisory sent to sites


This advisory has been prepared as part of the effort to fulfil EGI SVG's
purpose "To minimize the risk to the EGI infrastructure arising from software

The risk is that assessed by the group, according to the EGI SVG issue handling
procedure [R 3] in the context of how the software is used in the EGI
infrastructure. It is the opinion of the group, we do not guarantee it to be
correct. The risk may also be higher or lower in other deployments depending on
how the software is used.

This advisory is subject to the Creative commons license and the EGI
Software Vulnerability Group must be credited.

Note that the SVG issue handling procedure is currently under review, to take
account of the increasing inhomogeneity of the EGI infrastructure and the
services in the EOSC-hub catalogue.

On behalf of the EGI SVG,