~ / search / GHSA-8v8f-vc72-pmhc

GHSA-8v8f-vc72-pmhc

OpenStack Identity Keystone Exposure of Sensitive Information

Source: GitHub Advisory Database (reviewed) Moderate CVE-2014-3621

Packages

EcosystemPackageAffectedFixed in
PyPI keystone < 8.0.0a0 8.0.0a0

Details

As written in the advisory (Markdown source, shown as plain text).

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.

References

External links from the advisory. They lead to third-party sites.