PT-2013-6022 · Openstack+2 · Openstack Ceilometer+2

Eric Brown · Published 2013-11-23 · Updated 2020-10-21 · CVE-2013-6384

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Ceilometer versions 2013.2 and earlier

Description The issue allows local users to obtain sensitive information, specifically the DB2 or MongoDB password, by reading the log file when the logging level is set to INFO. This occurs because the connection string from ceilometer.conf is logged by impl db2.py and impl mongodb.py.

Recommendations For OpenStack Ceilometer versions 2013.2 and earlier, consider changing the logging level from INFO to a less verbose setting to prevent sensitive information from being logged. As a temporary workaround, restrict access to the log files to minimize the risk of exploitation.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2013-6384

Affected Products

Db2

Mongodb

Openstack Ceilometer

References · 7

• 🔥 https://bugs.launchpad.net/ceilometer/+bug/1244476 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2013-6384 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2013-6384 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-6384 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-6384 · Vendor Advisory
• http://openwall.com/lists/oss-security/2013/11/22/3 · Note
• http://openwall.com/lists/oss-security/2013/11/25/3 · Note