OpenStack Glance logs user name and password in cleartext
store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2013-0212US | medium4.0 | Exploit | ||
store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password… | ||||
02
references
External citations — patches, advisories, analysis.
- http://rhn.redhat.com/errata/RHSA-2013-0209.htmlWEB
- http://ubuntu.com/usn/usn-1710-1WEB
- http://www.openwall.com/lists/oss-security/2013/01/29/10WEB
- https://access.redhat.com/errata/RHSA-2013:0209WEB
- https://access.redhat.com/security/cve/CVE-2013-0212WEB
- https://bugs.launchpad.net/glance/+bug/1098962WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=902964WEB
- https://github.com/openstack/glancePACKAGE
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan