oss-sec mailing list archives
Re: CVE request for vulnerability in OpenStack Keystone
From: cve-assign () mitre org
Date: Mon, 4 May 2015 12:55:11 -0400 (EDT)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
Title: Potential Keystone cache backend password leak in log Affects: versions through 2014.1.4, and 2014.2 versions through 2014.2.3
The backend_argument configuration option content is being logged, and it may contain sensitive information for specific backends (like a password for MongoDB). An attacker with read access to Keystone logs may therefore obtain sensitive data
https://launchpad.net/bugs/1443598
there are other backends provided by dogpile that support authentication through "arguments" (which keystone exposes as "backend_arguments"):
In addition, custom cache backend implementations could also utilize backend_arguments. All of those would be affected as well.
Use CVE-2015-3646. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJVR6IJAAoJEKllVAevmvms/qkH/3xbAcGsfGXCxlscmRmfInDR 3LoP1RjtJrn3NSYhUTBj8dNXT5qnD0W7uf2WtUh5l1nRQ4O1qWJvMGizNTHZVtfi dkONWWk33bYg8nNwmlrS1Famy4i7i7yCFRbcpOTaYXad668dzSp0xLq4gcrTlR2A uXySvJ/ohW8fSzbAtD6yh03JEB6iZ5yV1aYYJHiLc+DIq7ptymOEQ4DRbUqb8EAT WL12gOTrL/cAPZsX/s5REnEJ10gYwif7Bpl3lRKELLK4tCPw2mIcZHfih+0HJCw3 ntqJg1T8KEYUkgrWnoiQOig1lPQBq2UeFdPB+eYvpPShJHLjqtwEum1XDlkR1fI= =/tHl -----END PGP SIGNATURE-----
Current thread:
- CVE request for vulnerability in OpenStack Keystone Tristan Cacqueray (May 04)
- Re: CVE request for vulnerability in OpenStack Keystone cve-assign (May 04)