CVE-2013-2013 python-keystoneclient unsecure user password update
LowCVSS 2.1
EPSS 0.37%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi python-keystoneclient(PyPI) | < 0.2.4 | 0.2.4 |
| pypi python-keystoneclient(PyPI) | = 0.1.1 | No fix listed |
| pypi python-keystoneclient(PyPI) | = 0.1.2 | No fix listed |
| pypi python-keystoneclient(PyPI) | = 0.1.3 | No fix listed |
| pypi python-keystoneclient(PyPI) | = 0.2.0 | No fix listed |
| pypi python-keystoneclient(PyPI) | = 0.2.1 | No fix listed |
| pypi python-keystoneclient(PyPI) | = 0.2.2 | No fix listed |
| pypi python-keystoneclient(PyPI) | = 0.2.3 | No fix listed |
| debian/python-keystoneclient(Debian:12) | < 1:0.2.5-1 | 1:0.2.5-1 |
| debian/python-keystoneclient(Debian:13) | < 1:0.2.5-1 | 1:0.2.5-1 |
| debian/python-keystoneclient(Debian:14) | < 1:0.2.5-1 | 1:0.2.5-1 |
| OpenStack python-keystoneclient | <= 0.2.3 | No fix listed |
| OpenStack python-keystoneclient | = 0.2.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- bugs.launchpad.net
- github.com product
- github.com
- oval:org.mitre.oval:def:16937 signature vdb-entry
- [oss-security] 20130523 [Openstack] [OSSA 2013-013] Keystone client local information disclosure (CVE-2013-2013) mailing-list patch
- github.com vendor-advisory
- Debian Security Tracker CVE-2013-2013 vendor-advisory
- bugs.debian.org issue-tracking