What is GHSA-jwpw-ppj5-7h4w?

GHSA-jwpw-ppj5-7h4w is a security advisory published by GitHub Security Advisories with Medium severity. OpenStack Keystone Logs Passwords

Which CVE IDs does GHSA-jwpw-ppj5-7h4w cover?

GHSA-jwpw-ppj5-7h4w covers the following CVE IDs: CVE-2015-3646. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-jwpw-ppj5-7h4w?

GHSA-jwpw-ppj5-7h4w affects 2 products, including: pip/keystone:\u003e= 2014.2, \u003c 2014.2.4; pip/keystone:\u003e= 2011.3, \u003c 2014.1.5.

GHSA-jwpw-ppj5-7h4wMedium

OpenStack Keystone Logs Passwords

Vendor

GitHub Security Advisories

Published

May 13, 2022

Last Modified

December 7, 2023

🔗 CVE IDs covered (1)

CVE-2015-3646 →

📋 Description

OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.

🎯 Affected products2

pip/keystone:>= 2014.2, < 2014.2.4
pip/keystone:>= 2011.3, < 2014.1.5

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2015-3646
https://bugs.launchpad.net/keystone/+bug/1443598
http://lists.openstack.org/pipermail/openstack-announce/2015-May/000356.html
http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html
https://web.archive.org/web/20210122154200/http://www.securityfocus.com/bid/74456
https://github.com/advisories/GHSA-jwpw-ppj5-7h4w