CVE-2014-3621

Опубликовано: 02 окт. 2014

Источник: nvd

CVSS2: 4

EPSS Низкий

Описание

The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.

Ссылки

http://rhn.redhat.com/errata/RHSA-2014-1688.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1789.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1790.html
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/09/16/10
Mailing List
Patch
Third Party Advisory
http://www.ubuntu.com/usn/USN-2406-1
Third Party Advisory
https://bugs.launchpad.net/keystone/+bug/1354208
Exploit
Issue Tracking
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1688.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1789.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-1790.html
Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/09/16/10
Mailing List
Patch
Third Party Advisory
http://www.ubuntu.com/usn/USN-2406-1
Third Party Advisory
https://bugs.launchpad.net/keystone/+bug/1354208
Exploit
Issue Tracking
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*

Версия от 2013.2 (включая) до 2013.2.3 (исключая)

cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*

Версия от 2014.1 (включая) до 2014.1.2.1 (исключая)

Конфигурация 2

cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

Конфигурация 3

Одновременно

cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:*

Одно из

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Конфигурация 4

cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:*

EPSS

Процентиль: 82%

0.02126

Низкий

4 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

CVE-2014-3621

ubuntu

около 12 лет назад

CVE-2014-3621

redhat

около 12 лет назад

CVE-2014-3621

debian

около 12 лет назад

The catalog url replacement in OpenStack Identity (Keystone) before 20 ...

GHSA-8v8f-vc72-pmhc

github

больше 4 лет назад

OpenStack Identity Keystone Exposure of Sensitive Information

ALT-PU-2014-3224

altlinux

около 12 лет назад

ALT-PU-2014-3224: package `openstack-keystone` update to version 2014.1.2.1-alt1

EPSS

Процентиль: 82%

0.02126

Низкий

4 Medium

CVSS2

Дефекты

CWE-200