PT-2015-6253 · Openstack · Openstack Identity

Eric Brown · Publicado 2015-05-12 · Atualizado 2022-05-13 · CVE-2015-3646

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Identity (Keystone) versions prior to 2014.1.5 OpenStack Identity (Keystone) versions 2014.2.x prior to 2014.2.4

Description The issue allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs, as the backend argument configuration option content is logged.

Recommendations For versions prior to 2014.1.5, update to version 2014.1.5 or later. For versions 2014.2.x prior to 2014.2.4, update to version 2014.2.4 or later.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-3646

GHSA-JWPW-PPJ5-7H4W

SUSE-SU-2016:2325-1

Produtos afetados

Openstack Identity

Referências · 23

• https://github.com/openstack/keystone · Nota
• https://bugzilla.suse.com/929628 · Nota
• http://lists.openstack.org/pipermail/openstack-announce/2015-May/000356.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2015-3646 · Aviso do Fabricante
• https://bugzilla.suse.com/967356 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-3646 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-3646 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2015-3646 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-jwpw-ppj5-7h4w · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-3646 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-3646 · Nota
• https://suse.com/support/update/announcement/2016/suse-su-20162325-1 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-3646 · Nota de Segurança
• https://bugzilla.suse.com/960601 · Nota
• https://bugs.launchpad.net/keystone/+bug/1443598 · Nota