CVE-2013-2006: OpenStack Keystone Sensitive information disclosure via log files
(updated )
OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaintext, which allows local users to obtain sensitive by reading the log file.
References
- bugs.launchpad.net/keystone/+bug/1172195
- bugs.launchpad.net/ossn/+bug/1168252
- github.com/advisories/GHSA-rxrm-xvp4-jqvh
- github.com/openstack/keystone
- github.com/openstack/keystone/commit/c5037dd6b82909efaaa8720e8cfa8bdb8b4a0edd
- github.com/openstack/keystone/commit/d43e2a51a1ed7adbed3c5ddf001d46bc4a824ae8
- github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2013-40.yaml
- nvd.nist.gov/vuln/detail/CVE-2013-2006
Code Behaviors & Features
Detect and mitigate CVE-2013-2006 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →