CVE-2013-2013: Infoleak
Published Oct 1, 2013
·Updated
The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process.
Affected Software
3 affected componentsFixes available
pip/python-keystoneclient<0.2.4
0.2.4
Openstack python-keystoneclient<=0.2.3
Openstack python-keystoneclient=0.2.2
Remediation
Patch Available
Event History
Oct 1, 2013
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
May 17, 2022
Advisory Published
12:55 AM
Frequently Asked Questions
1
What is the severity of CVE-2013-2013?
CVE-2013-2013 is considered a medium severity vulnerability due to its potential for exposing sensitive information.
2
How do I fix CVE-2013-2013?
To fix CVE-2013-2013, upgrade python-keystoneclient to version 0.2.4 or later.
3
Who is affected by CVE-2013-2013?
Users of python-keystoneclient versions before 0.2.4 are affected by CVE-2013-2013.
4
What causes CVE-2013-2013?
CVE-2013-2013 is caused by the user-password-update command accepting passwords through a parameter that can be viewed in process listings.
5
Is CVE-2013-2013 a local or remote vulnerability?
CVE-2013-2013 is a local vulnerability, as it requires local user access to exploit.