CVE-2013-6384: Low severity Openstack ceilometer vulnerability
(1) impldb2.py and (2) implmongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceilometer.conf, which allows local users to obtain sensitive information (the DB2 or MongoDB password) by reading the log file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-6384?
CVE-2013-6384 is classified as a moderate severity vulnerability due to the exposure of sensitive database connection strings.
How do I fix CVE-2013-6384?
To fix CVE-2013-6384, update OpenStack Ceilometer to version 2013.2.1 or later and ensure logging is set to a level higher than INFO.
Who is affected by CVE-2013-6384?
OpenStack Ceilometer versions 2013.2 and earlier are affected by CVE-2013-6384.
What information is exposed by CVE-2013-6384?
CVE-2013-6384 exposes sensitive database connection strings, including passwords for DB2 or MongoDB, in log files.
Can local users exploit CVE-2013-6384?
Yes, local users can exploit CVE-2013-6384 by accessing log files to retrieve sensitive information.