PT-2013-2160 · Openstack · Openstack Glance

Dan Prince · Publicado 2013-02-24 · Atualizado 2023-02-13 · CVE-2013-0212

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Glance versions 2012.1, 2012.2 before 2012.2.3, and 2012.2.3 and earlier of Grizzly

Description The issue allows remote authenticated users to obtain sensitive information by reading error messages. This occurs when the Swift endpoint is misconfigured or unusable in Swift single tenant mode, causing the store/swift.py component to log the Swift endpoint's user name and password in cleartext.

Recommendations For OpenStack Glance version 2012.1, update to a version that includes the necessary security fixes. For OpenStack Glance version 2012.2 before 2012.2.3, update to version 2012.2.3 or later. For OpenStack Glance Grizzly versions prior to the fix, update to a version that includes the necessary security fixes. As a temporary workaround, consider restricting access to the error messages to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2013-0212

GHSA-XV7J-2V4W-CJVH

PYSEC-2013-37

RHSA-2013:0209

Produtos afetados

Openstack Glance

Referências · 23

• https://github.com/openstack/glance · Nota
• https://github.com/openstack/glance/commit/96a470be64adcef97f235ca96ed3c59ed954a4c1 · Nota
• https://github.com/openstack/glance/commit/37d4d96bf88c2bf3e7e9511b5e321cf4bed364b7 · Nota
• https://github.com/openstack/glance/commit/e96273112b5b5da58d970796b7cfce04c5030a89 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2013-37.yaml · Nota
• https://security-tracker.debian.org/tracker/CVE-2013-0212 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2013-37 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/01/29/10 · Nota
• https://access.redhat.com/security/cve/CVE-2013-0212 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-0212 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2013-0209.html · Aviso do Fabricante
• http://secunia.com/advisories/51957 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-0212 · Aviso do Fabricante
• http://secunia.com/advisories/51990 · Aviso do Fabricante
• https://bugs.launchpad.net/glance/+bug/1098962 · Nota