Dell Enterprise SONiC (sensitive information in log files): Sensitive information is written into log files

Impact

Sensitive information is written into log files on the switch. Switch logs are routinely shipped wholesale to a central syslog or observability stack that far more people can read than can log into the switch — so secrets written to the log leak to a much wider audience than the device's own access control implies.

Who can reach it

Anyone with read access to the switch's logs or to the log aggregation pipeline they are shipped to.

What to do

Upgrade to Enterprise SONiC 4.4.1 or 4.2.3 or later — NOS image upgrade plus reboot. Also purge historical logs from your aggregator and rotate anything that appeared in them; that cleanup is the part people skip.

References