GitHub Advisoryadvisory · PyPI

GHSA-4xw6-hj5p-4j79 OpenStack Glance sensitive information disclosure via logs

MEDIUM Published 2022-05-17 Modified 2024-11-26 Official page ↗
Aliases
CVE-2014-1948
Ecosystem
PyPI
Packages
glance
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-532
Reviewed
2024-05-14

Affected packages

• PyPI glance: < 11.0.0a0 → fixed in 11.0.0a0

Description

OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.

Related

Alias · CVE (1)

  • CVE-2014-1948 OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the… vulnerability

Weakness · CWE (1)

  • CWE-532 Insertion of Sensitive Information into Log File weakness

References