CVE-2013-0212: Infoleak
store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.
Other sources
Thierry Carrez (thierry) reports on behalf of the OpenStack Project:
Title: Backend password leak in Glance error message Reporter: Dan Prince (Red Hat) Products: Glance Affects: All versions
Dan Prince of Red Hat discovered an issue in Glance error reporting. By creating an image in Glance by URL that references a mis-configured Swift endpoint, or if the Swift endpoint that a previously-ACTIVE image references for any reason becomes unusable, an authenticated user may access the Glance operator's Swift credentials for that endpoint. Only setups that use the single-tenant Swift store are affected.
Proposed patches: See attached patches for current development tree (Grizzly) and the Folsom and Essex series. Unless a flaw is discovered in them, these proposed patches will be merged to Glance master, stable/folsom and stable/essex branches on the public disclosure date.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-0212?
CVE-2013-0212 is classified as a moderate severity vulnerability due to the exposure of sensitive user credentials.
How do I fix CVE-2013-0212?
To remediate CVE-2013-0212, upgrade to OpenStack Glance version 2012.2.3 or later.
Which versions are affected by CVE-2013-0212?
CVE-2013-0212 affects OpenStack Glance versions 2012.1, 2012.2, 2012.2.1, and 2012.2.2.
What kind of information is exposed in CVE-2013-0212?
CVE-2013-0212 exposes the Swift endpoint's user name and password in cleartext.
In what mode does CVE-2013-0212 occur?
CVE-2013-0212 occurs when OpenStack Glance is configured to run in Swift single tenant mode.