PT-2013-2160 · Openstack · Openstack Glance

Dan Prince · Published 2013-02-24 · Updated 2023-02-13 · CVE-2013-0212

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Glance versions 2012.1, 2012.2 before 2012.2.3, and 2012.2.3 and earlier of Grizzly

Description The issue allows remote authenticated users to obtain sensitive information by reading error messages. This occurs when the Swift endpoint is misconfigured or unusable in Swift single tenant mode, causing the store/swift.py component to log the Swift endpoint's user name and password in cleartext.

Recommendations For OpenStack Glance version 2012.1, update to a version that includes the necessary security fixes. For OpenStack Glance version 2012.2 before 2012.2.3, update to version 2012.2.3 or later. For OpenStack Glance Grizzly versions prior to the fix, update to a version that includes the necessary security fixes. As a temporary workaround, consider restricting access to the error messages to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-0212

GHSA-XV7J-2V4W-CJVH

RHSA-2013:0209

Affected Products

Openstack Glance

References · 21

• http://rhn.redhat.com/errata/RHSA-2013-0209.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=902964 · Patch
• http://secunia.com/advisories/51957 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0212 · Security Note
• https://osv.dev/vulnerability/CVE-2013-0212 · Vendor Advisory
• http://secunia.com/advisories/51990 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xv7j-2v4w-cjvh · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-0212 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-0212 · Vendor Advisory
• https://github.com/openstack/glance · Note
• https://github.com/openstack/glance/commit/96a470be64adcef97f235ca96ed3c59ed954a4c1 · Note
• https://github.com/openstack/glance/commit/37d4d96bf88c2bf3e7e9511b5e321cf4bed364b7 · Note
• https://github.com/openstack/glance/commit/e96273112b5b5da58d970796b7cfce04c5030a89 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2013-37.yaml · Note
• https://launchpad.net/glance/+milestone/2012.2.3 · Note