[openstack-announce] [OSSA 2015-008] Potential Keystone cache backend password leak in log (CVE-2015-3646)

Tristan Cacqueray tristan.cacqueray at enovance.com
Tue May 5 12:21:52 UTC 2015


====================================================================
OSSA-2015-008: Potential Keystone cache backend password leak in log
====================================================================

:Date: May 04, 2015
:CVE: CVE-2015-3646


Affects
~~~~~~~
- Keystone: versions through 2014.1.4,
            and 2014.2 versions through 2014.2.3


Description
~~~~~~~~~~~
Eric Brown from VMware reported a vulnerability in Keystone. The
backend_argument configuration option content is being logged, and it
may contain sensitive information for specific backends (like a
password for MongoDB). An attacker with read access to Keystone logs
may therefore obtain sensitive data about certain backends. All
Keystone setups are potentially impacted.


Patches
~~~~~~~
- https://review.openstack.org/175519 (Icehouse)
- https://review.openstack.org/173116 (Juno)


Credits
~~~~~~~
- Eric Brown from VMware (CVE-2015-3646)


References
~~~~~~~~~~
- https://launchpad.net/bugs/1443598
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3646


Notes
~~~~~
- This fix will be included in future 2014.1.5 (icehouse) and 2014.2.4
  (juno) releases.
- The 2015.1.0 (kilo) release is not affected.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 473 bytes
Desc: OpenPGP digital signature
URL: <http://lists.openstack.org/pipermail/openstack-announce/attachments/20150505/5df1961b/attachment.pgp>


More information about the OpenStack-announce mailing list