PT-2013-6308 · Openstack · Openstack Glance

Published 2013-02-24 · Updated 2013-02-24

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions OpenStack Glance versions 2012.1, 2012.2 before 2012.2.3, and 2012.2.3 and earlier of Grizzly

Description The issue allows remote authenticated users to obtain sensitive information by reading error messages. This occurs when the Swift endpoint is misconfigured or unusable in Swift single tenant mode, causing the user name and password to be logged in cleartext.

Recommendations For OpenStack Glance version 2012.1, update to a version later than 2012.1 to resolve the issue. For OpenStack Glance version 2012.2 before 2012.2.3, update to version 2012.2.3 or later to resolve the issue. For OpenStack Glance Grizzly versions 2012.2.3 and earlier, update to a version later than 2012.2.3 to resolve the issue.

Related Identifiers

PYSEC-2013-37

Affected Products

Openstack Glance

References · 13

• https://osv.dev/vulnerability/PYSEC-2013-37 · Vendor Advisory
• https://github.com/openstack/glance/commit/e96273112b5b5da58d970796b7cfce04c5030a89 · Note
• https://github.com/openstack/glance/commit/96a470be64adcef97f235ca96ed3c59ed954a4c1 · Note
• https://github.com/openstack/glance/commit/37d4d96bf88c2bf3e7e9511b5e321cf4bed364b7 · Note
• http://rhn.redhat.com/errata/RHSA-2013-0209.html · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=902964 · Note
• http://secunia.com/advisories/51957 · Note
• http://ubuntu.com/usn/usn-1710-1 · Note
• http://secunia.com/advisories/51990 · Note
• https://launchpad.net/glance/+milestone/2012.2.3 · Note
• https://lists.launchpad.net/openstack/msg20517.html · Note
• http://openwall.com/lists/oss-security/2013/01/29/10 · Note
• https://bugs.launchpad.net/glance/+bug/1098962 · Note