CVE-2013-2006: Infoleak
OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admintoken and (2) LDAP password in plaintext, which allows local users to obtain sensitive by reading the log file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-2006?
CVE-2013-2006 is considered a moderate severity vulnerability due to its potential exposure of sensitive information in log files.
How do I fix CVE-2013-2006?
To remediate CVE-2013-2006, disable DEBUG logging in OpenStack Keystone or upgrade to a fixed version of the software that removes this logging behavior.
What versions of OpenStack Keystone are affected by CVE-2013-2006?
CVE-2013-2006 specifically affects OpenStack Identity Keystone version 2013.1.1.
What sensitive information is exposed in CVE-2013-2006?
CVE-2013-2006 can expose the admin_token and LDAP password in plaintext through debug logs.
Can local users exploit CVE-2013-2006?
Yes, local users with access to the log files can exploit CVE-2013-2006 to obtain sensitive credentials.