CVE-2013-0212

store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.

CVSS v2.0 4.0 MEDIUM

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://bugzilla.redhat.com/show_bug.cgi?id=902964	Patch
http://www.openwall.com/lists/oss-security/2013/01/29/10
https://lists.launchpad.net/openstack/msg20517.html
https://github.com/openstack/glance/commit/e96273112b5b5da58d970796b7cfce04c5030a89
http://ubuntu.com/usn/usn-1710-1	Patch
http://secunia.com/advisories/51990	Vendor Advisory
https://launchpad.net/glance/+milestone/2012.2.3
http://rhn.redhat.com/errata/RHSA-2013-0209.html	Vendor Advisory
https://bugs.launchpad.net/glance/+bug/1098962
https://github.com/openstack/glance/commit/37d4d96bf88c2bf3e7e9511b5e321cf4bed364b7
http://secunia.com/advisories/51957	Vendor Advisory
https://github.com/openstack/glance/commit/96a470be64adcef97f235ca96ed3c59ed954a4c1

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):2012.2.2:::::::*
	cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):2012.2.1:::::::*
	cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):2012.1:::::::*
	cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):2012.2:::::::*

Configuration 2 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:11.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:12.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:::::*

Information

Published : 2013-02-24 13:55

Updated : 2023-02-12 20:38

NVD link : CVE-2013-0212

Mitre link : CVE-2013-0212

JSON object : View

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Advertisement

Products Affected

canonical

ubuntu_linux

openstack

image_registry_and_delivery_service_\(glance\)

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=902964", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=902964", "tags": ["Patch"], "refsource": "MISC"}, {"url": "http://www.openwall.com/lists/oss-security/2013/01/29/10", "name": "[oss-security] 20130129 [OSSA 2013-002] Backend password leak in Glance error message (CVE-2013-0212)", "tags": [], "refsource": "MLIST"}, {"url": "https://lists.launchpad.net/openstack/msg20517.html", "name": "[openstack] 20130129 [OSSA 2013-002] Backend password leak in Glance error message (CVE-2013-0212)", "tags": [], "refsource": "MLIST"}, {"url": "https://github.com/openstack/glance/commit/e96273112b5b5da58d970796b7cfce04c5030a89", "name": "https://github.com/openstack/glance/commit/e96273112b5b5da58d970796b7cfce04c5030a89", "tags": [], "refsource": "CONFIRM"}, {"url": "http://ubuntu.com/usn/usn-1710-1", "name": "USN-1710-1", "tags": ["Patch"], "refsource": "UBUNTU"}, {"url": "http://secunia.com/advisories/51990", "name": "51990", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "https://launchpad.net/glance/+milestone/2012.2.3", "name": "https://launchpad.net/glance/+milestone/2012.2.3", "tags": [], "refsource": "CONFIRM"}, {"url": "http://rhn.redhat.com/errata/RHSA-2013-0209.html", "name": "RHSA-2013:0209", "tags": ["Vendor Advisory"], "refsource": "REDHAT"}, {"url": "https://bugs.launchpad.net/glance/+bug/1098962", "name": "https://bugs.launchpad.net/glance/+bug/1098962", "tags": [], "refsource": "CONFIRM"}, {"url": "https://github.com/openstack/glance/commit/37d4d96bf88c2bf3e7e9511b5e321cf4bed364b7", "name": "https://github.com/openstack/glance/commit/37d4d96bf88c2bf3e7e9511b5e321cf4bed364b7", "tags": [], "refsource": "CONFIRM"}, {"url": "http://secunia.com/advisories/51957", "name": "51957", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "https://github.com/openstack/glance/commit/96a470be64adcef97f235ca96ed3c59ed954a4c1", "name": "https://github.com/openstack/glance/commit/96a470be64adcef97f235ca96ed3c59ed954a4c1", "tags": [], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-200"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2013-0212", "ASSIGNER": "secalert@redhat.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2013-02-24T21:55Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:openstack:image_registry_and_delivery_service_\\(glance\\):2012.2.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:openstack:image_registry_and_delivery_service_\\(glance\\):2012.2.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:openstack:image_registry_and_delivery_service_\\(glance\\):2012.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:openstack:image_registry_and_delivery_service_\\(glance\\):2012.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2023-02-13T04:38Z"}