GitHub Advisoryadvisory · PyPI

GHSA-jwpw-ppj5-7h4w OpenStack Keystone Logs Passwords

MEDIUM Published 2022-05-13 Modified 2023-12-07 Official page ↗
Aliases
CVE-2015-3646
Ecosystem
PyPI
Packages
keystone
Severity
Moderate
Weaknesses
CWE-200
Reviewed
2023-08-01

Affected packages

• PyPI keystone: >= 2011.3, < 2014.1.5 → fixed in 2014.1.5 • PyPI keystone: >= 2014.2, < 2014.2.4 → fixed in 2014.2.4

Description

OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.

Related

Alias · CVE (1)

  • CVE-2015-3646 OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which… vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References