CVE-2013-2006

Advisory

OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaintext, which allows local users to obtain sensitive by reading the log file.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://bugs.launchpad.net/ossn/+bug/1168252
• http://rhn.redhat.com/errata/RHSA-2013-0806.html
• http://www.openwall.com/lists/oss-security/2013/04/24/1
• https://bugs.launchpad.net/keystone/+bug/1172195
• http://www.securityfocus.com/bid/59411
• http://www.openwall.com/lists/oss-security/2013/04/24/2
• https://github.com/openstack/keystone/commit/c5037dd6b82909efaaa8720e8cfa8bdb8b4a0edd
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106220.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2006