CVE-2014-1948 OpenStack Glance sensitive information disclosure via logs
LowCVSS 2.6
EPSS 0.31%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi glance(PyPI) | < 11.0.0a0 | 11.0.0a0 |
| debian/glance(Debian:12) | < 2013.2.2-1 | 2013.2.2-1 |
| debian/glance(Debian:13) | < 2013.2.2-1 | 2013.2.2-1 |
| debian/glance(Debian:14) | < 2013.2.2-1 | 2013.2.2-1 |
| OpenStack image registry and delivery service glance | = 2013.2 | No fix listed |
| OpenStack image registry and delivery service glance | = 2013.2.1 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- bugs.launchpad.net
- github.com product
- github.com
- RHSA-2014:0229 vendor-advisory
- [oss-security] 20140212 [OSSA 2014-004] Glance Swift store backend password leak (CVE-2014-1948) mailing-list
- 65507 vdb-entry
- 56419 third-party-advisory vendor-advisory
- Debian Security Tracker CVE-2014-1948 vendor-advisory
- github.com
- bugs.debian.org issue-tracking