PT-2013-3501 · Openstack · Openstack Identity

Kseifried + 1 · Publicado 2013-05-21 · Atualizado 2022-05-17 · CVE-2013-2006

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Identity (Keystone) version 2013.1.1

Description The issue allows local users to obtain sensitive information by reading the log file when DEBUG mode logging is enabled. Specifically, it logs the admin token and LDAP password in plaintext.

Recommendations For OpenStack Identity (Keystone) version 2013.1.1, consider disabling DEBUG mode logging to prevent sensitive information from being logged in plaintext. As a temporary workaround, restrict access to the log file to minimize the risk of exploitation.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2013-2006

GHSA-RXRM-XVP4-JQVH

PYSEC-2013-40

RHSA-2013:0806

Produtos afetados

Openstack Identity

Referências · 19

• https://github.com/openstack/keystone/commit/c5037dd6b82909efaaa8720e8cfa8bdb8b4a0edd · Nota
• https://github.com/openstack/keystone · Nota
• https://github.com/openstack/keystone/commit/d43e2a51a1ed7adbed3c5ddf001d46bc4a824ae8 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2013-40.yaml · Nota
• http://openwall.com/lists/oss-security/2013/04/24/2 · Nota
• https://bugs.launchpad.net/keystone/+bug/1172195 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html · Aviso do Fabricante
• https://bugs.launchpad.net/ossn/+bug/1168252 · Nota
• https://security-tracker.debian.org/tracker/CVE-2013-2006 · Aviso do Fabricante
• https://github.com/advisories/GHSA-rxrm-xvp4-jqvh · Nota
• http://rhn.redhat.com/errata/RHSA-2013-0806.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-2006 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2013-2006 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106220.html · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2013/04/24/1 · Nota