PT-2013-3501 · Openstack · Openstack Identity

Kseifried + 1 · Published 2013-05-21 · Updated 2022-05-17 · CVE-2013-2006

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Identity (Keystone) version 2013.1.1

Description The issue allows local users to obtain sensitive information by reading the log file when DEBUG mode logging is enabled. Specifically, it logs the admin token and LDAP password in plaintext.

Recommendations For OpenStack Identity (Keystone) version 2013.1.1, consider disabling DEBUG mode logging to prevent sensitive information from being logged in plaintext. As a temporary workaround, restrict access to the log file to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-2006

GHSA-RXRM-XVP4-JQVH

PYSEC-2013-40

RHSA-2013:0806

Affected Products

Openstack Identity

References · 19

• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-2006 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0806.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-2006 · Security Note
• https://osv.dev/vulnerability/CVE-2013-2006 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106220.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rxrm-xvp4-jqvh · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2013-40 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-2006 · Vendor Advisory
• https://github.com/openstack/keystone/commit/c5037dd6b82909efaaa8720e8cfa8bdb8b4a0edd · Note
• https://github.com/openstack/keystone · Note
• https://github.com/openstack/keystone/commit/d43e2a51a1ed7adbed3c5ddf001d46bc4a824ae8 · Note
• https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2013-40.yaml · Note
• http://openwall.com/lists/oss-security/2013/04/24/2 · Note
• https://bugs.launchpad.net/keystone/+bug/1172195 · Note