CVSS: 3.3EPSS: 0%CPEs: 2EXPL: 0CVE-2014-1948 – openstack-glance: Glance Swift store backend password leak
https://notcve.org/view.php?id=CVE-2014-1948
OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log. OpenStack Image Registry and Delivery Service (Glance) 2013.2 hasta 2013.2.1 y Icehouse anterior a icehouse-2 registra una URL que contiene la contraseña de Swift store backend cuando falla la autenticación y el registro a nivel de advertencia está habilitado, lo que permite a usuarios locales obtener información sensible mediante la lectura del registro. • http://rhn.redhat.com/errata/RHSA-2014-0229.html http://secunia.com/advisories/56419 http://www.openwall.com/lists/oss-security/2014/02/12/18 http://www.securityfocus.com/bid/65507 https://bugs.launchpad.net/glance/+bug/1275062 https://access.redhat.com/security/cve/CVE-2014-1948 https://bugzilla.redhat.com/show_bug.cgi?id=1064589 • CWE-255: Credentials Management Errors CWE-532: Insertion of Sensitive Information into Log File •
CVSS: 2.1EPSS: 0%CPEs: 1EXPL: 0CVE-2013-4354
https://notcve.org/view.php?id=CVE-2013-4354
The API before 2.1 in OpenStack Image Registry and Delivery Service (Glance) makes it easier for local users to inject images into arbitrary tenants by adding the tenant as a member of the image. El API anterior a 2,1 en OpenStack Image Registry and Delivery Service (Glance) hace que sea más fácil para los usuarios locales inyectar imágenes en inquilinos arbitrarios añadiendo el inquilino como un miembro de la imagen. • http://www.openwall.com/lists/oss-security/2013/09/19/2 http://www.openwall.com/lists/oss-security/2013/09/19/3 https://bugs.launchpad.net/glance/+bug/1226078 • CWE-20: Improper Input Validation •
CVSS: 6.3EPSS: 0%CPEs: 7EXPL: 2CVE-2013-4428 – Glance: image_download policy not enforced for cached images
https://notcve.org/view.php?id=CVE-2013-4428
OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly before 2013.1.4, and Havana before 2013.2, when the download_image policy is configured, does not properly restrict access to cached images, which allows remote authenticated users to read otherwise restricted images via an image UUID. OpenStack Image Registry and Delivery Service (Glance) Folsom, Grizzly con versiones anteriores a 2013.1.4, y Havana con versiones anteriores a 2013.2, cuando se configura la política image_download, no restringe adecuadamente el acceso a las imágenes almacenadas en caché, lo que permite a usuarios remotos autenticados leer de otra manera imágenes restringidas a través de un imagen UUID. • http://rhn.redhat.com/errata/RHSA-2013-1525.html http://www.openwall.com/lists/oss-security/2013/10/15/8 http://www.openwall.com/lists/oss-security/2013/10/16/9 http://www.securityfocus.com/bid/63159 http://www.ubuntu.com/usn/USN-2003-1 https://bugs.launchpad.net/glance/+bug/1235226 https://bugs.launchpad.net/glance/+bug/1235378 https://launchpad.net/glance/+milestone/2013.1.4 https://launchpad.net/glance/+milestone/2013.2 https://access.redhat&# • CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 3.5EPSS: 0%CPEs: 5EXPL: 0CVE-2013-1840 – Glance: Backend credentials leak in Glance v1 API
https://notcve.org/view.php?id=CVE-2013-1840
The v1 API in OpenStack Glance Essex (2012.1), Folsom (2012.2), and Grizzly, when using the single-tenant Swift or S3 store, reports the location field, which allows remote authenticated users to obtain the operator's backend credentials via a request for a cached image. La API v1 en OpenStack Vistazo Essex (2012.1), Folsom (2012.2) y Grizzly, al utilizar el 'single-tenant Swift' o la tienda S3, informa el campo de ubicación, lo que permite obtener las credenciales del back-end del operador a usuarios remotos autenticados a través de una solicitud de una imagen almacenada en caché. • http://osvdb.org/91304 http://rhn.redhat.com/errata/RHSA-2013-0707.html http://secunia.com/advisories/52565 http://www.openwall.com/lists/oss-security/2013/03/14/15 http://www.securityfocus.com/bid/58490 http://www.ubuntu.com/usn/USN-1764-1 https://bugs.launchpad.net/glance/+bug/1135541 https://exchange.xforce.ibmcloud.com/vulnerabilities/82878 https://review.openstack.org/#/c/24437 https://review.openstack.org/#/c/24438 https://review.openstack.org&#x • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.0EPSS: 0%CPEs: 7EXPL: 1CVE-2013-0212 – openstack-glance: Backend password leak in Glance error message
https://notcve.org/view.php?id=CVE-2013-0212
store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages. store/swift.py en OpenStack Glance Essex (2012.1), Folsom (2012.2) anterior a 2012.2.3, y Grizzly, cuando el modo singe tenant en Swift, guarda el usuario Swift remoto y el password en texto plano cuando el punto remoto es mal configurado, lo que permite a usuarios remotos autenticados obtener información sensible mediante la lectura de mensajes de error. • https://github.com/LogSec/CVE-2013-0212 http://rhn.redhat.com/errata/RHSA-2013-0209.html http://secunia.com/advisories/51957 http://secunia.com/advisories/51990 http://ubuntu.com/usn/usn-1710-1 http://www.openwall.com/lists/oss-security/2013/01/29/10 https://bugs.launchpad.net/glance/+bug/1098962 https://bugzilla.redhat.com/show_bug.cgi?id=902964 https://github.com/openstack/glance/commit/37d4d96bf88c2bf3e7e9511b5e321cf4bed364b7 https://github.com/openstack/glance/commit/ • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-209: Generation of Error Message Containing Sensitive Information •