OSSA-2015-008: Potential Keystone cache backend password leak in log
:Date: May 04, 2015
- Keystone: versions through 2014.1.4,
and 2014.2 versions through 2014.2.3
Eric Brown from VMware reported a vulnerability in Keystone. The
backend_argument configuration option content is being logged, and it
may contain sensitive information for specific backends (like a
password for MongoDB). An attacker with read access to Keystone logs
may therefore obtain sensitive data about certain backends. All
Keystone setups are potentially impacted.
- https://review.openstack.org/175519 (Icehouse)
- https://review.openstack.org/173116 (Juno)
- Eric Brown from VMware (CVE-2015-3646)
- This fix will be included in future 2014.1.5 (icehouse) and 2014.2.4
- The 2015.1.0 (kilo) release is not affected.
OpenStack-announce mailing list