PT-2014-5425 · Openstack+1 · Openstack Identity+1

Brant Knudson · Publicado 2014-10-02 · Atualizado 2023-02-13 · CVE-2014-3621

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Identity (Keystone) versions prior to 2013.2.3 OpenStack Identity (Keystone) versions 2014.1 prior to 2014.1.2.1

Description The issue allows remote authenticated users to read sensitive configuration options via a crafted endpoint. This can be demonstrated by using "$(admin token)" in the "publicurl" endpoint field.

Recommendations For versions prior to 2013.2.3, update to version 2013.2.3 or later. For versions 2014.1 prior to 2014.1.2.1, update to version 2014.1.2.1 or later.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2014-3621

GHSA-8V8F-VC72-PMHC

RHSA-2014:1688

RHSA-2014:1789

RHSA-2014:1790

USN-2406-1

Produtos afetados

Openstack Identity

Ubuntu

Referências · 25

• 🔥 https://bugs.launchpad.net/keystone/+bug/1354208 · Exploit
• https://github.com/openstack/keystone/commit/52714633c9a4dae5e60279217090859aa6dbcb4f · Nota
• https://github.com/openstack/keystone/commit/2989ff257e4fde6a168e25b926805e700406aa80 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-3621 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-8v8f-vc72-pmhc · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2014-1790.html · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-2406-1 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-3621 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-3621 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3621 · Nota de Segurança
• https://ubuntu.com/security/notices/USN-2406-1 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2014:1688 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=1139937 · Nota
• http://ubuntu.com/usn/USN-2406-1 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/09/16/10 · Correção