PT-2013-6309

Name of the Vulnerable Software and Affected Versions OpenStack Identity Keystone version 2013.1.1 Description The issue allows local users to obtain sensitive information by reading the log file when DEBUG mode logging is enabled. Specifically, it logs the admin token and LDAP password in...

keystone: DEBUG level LDAP password disclosure in log files

A flaw was found in OpenStack Identity keystone. When debug-level logging is enabled, the service logs the admin token and LDAP server password in plain text to the log file. A local attacker with access to these log files could obtain these credentials and gain unauthorized access to the system...

OpenStack Keystone不安全文件权限漏洞(CVE-2013-1977)

BUGTRAQ ID: 59310 CVECAN ID: CVE-2013-1977 OpenStack Keystone为OpenStack系列计划提供身份、令牌、目录和策略服务的项目。 Keystone.conf管理方式上存在安全漏洞，本地攻击者可利用此漏洞获取LDAP密码配置和admintoken。 0 openstack Keystone 厂商补丁： openstack --------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://lists.openstack.org/pipermail/openstack-announce/...