GHSA-jwpw-ppj5-7h4w

OpenStack Keystone Logs Passwords

Source: GitHub Advisory Database (reviewed) Moderate CVE-2015-3646

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	keystone	>= 2011.3, < 2014.1.5	2014.1.5
PyPI	keystone	>= 2014.2, < 2014.2.4	2014.2.4

Details

As written in the advisory (Markdown source, shown as plain text).

OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2015-3646 advisory
https://bugs.launchpad.net/keystone/+bug/1443598 web
https://github.com/openstack/keystone package
https://web.archive.org/web/20210122154200/http://www.securityfocus.com/bid/74456 web
http://lists.openstack.org/pipermail/openstack-announce/2015-May/000356.html web
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html web