Vulnerability Details CVE-2013-2006
OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaintext, which allows local users to obtain sensitive by reading the log file.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.006
EPSS Ranking 44.1%
CVSS Severity
CVSS v2 Score 2.1
References
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106220.html
- http://rhn.redhat.com/errata/RHSA-2013-0806.html
- http://www.openwall.com/lists/oss-security/2013/04/24/1
- http://www.openwall.com/lists/oss-security/2013/04/24/2
- http://www.securityfocus.com/bid/59411
- https://bugs.launchpad.net/keystone/+bug/1172195
- https://bugs.launchpad.net/ossn/+bug/1168252
- https://github.com/openstack/keystone/commit/c5037dd6b82909efaaa8720e8cfa8bdb8b4a0edd
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106220.html
- http://rhn.redhat.com/errata/RHSA-2013-0806.html
- http://www.openwall.com/lists/oss-security/2013/04/24/1
- http://www.openwall.com/lists/oss-security/2013/04/24/2
- http://www.securityfocus.com/bid/59411
- https://bugs.launchpad.net/keystone/+bug/1172195
- https://bugs.launchpad.net/ossn/+bug/1168252
- https://github.com/openstack/keystone/commit/c5037dd6b82909efaaa8720e8cfa8bdb8b4a0edd