Description
OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaintext, which allows local users to obtain sensitive by reading the log file.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://github.com/openstack/keystone/commit/c5037dd6b82909efaaa8720e8cfa8bdb8b4a0edd ↗
- http://www.securityfocus.com/bid/59411 ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html ↗
- https://bugs.launchpad.net/ossn/+bug/1168252 ↗
- http://rhn.redhat.com/errata/RHSA-2013-0806.html ↗
- http://www.openwall.com/lists/oss-security/2013/04/24/1 ↗
- http://lists.fedoraproject.org/pipermail/package-announce/2013-May/106220.html ↗
- https://bugs.launchpad.net/keystone/+bug/1172195 ↗
- http://www.openwall.com/lists/oss-security/2013/04/24/2 ↗