CVE-2015-3646: Infoleak

Q: What is the severity of CVE-2015-3646?

CVE-2015-3646 has a high severity level due to the potential exposure of sensitive backend information to authenticated users.

Q: How do I fix CVE-2015-3646?

To fix CVE-2015-3646, upgrade to Keystone version 2014.1.5 or 2014.2.4 or later.

Q: What type of vulnerability is CVE-2015-3646?

CVE-2015-3646 is a logging vulnerability that exposes sensitive data through log files.

Q: Who is affected by CVE-2015-3646?

CVE-2015-3646 affects users of OpenStack Identity (Keystone) before version 2014.1.5 and 2014.2.x before 2014.2.4.

Q: What kind of information can be exposed by CVE-2015-3646?

CVE-2015-3646 can expose sensitive information such as passwords and backend configuration details.

Published May 12, 2015

Updated

OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backendargument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.

Affected Software

5 affected componentsFixes available

pip/keystone>=2011.3<2014.1.5

2014.1.5

pip/keystone>=2014.2<2014.2.4

2014.2.4

Openstack Keystone>=2014.1<2014.1.5

Openstack Keystone>=2014.2.0<2014.2.4

Oracle Solaris=11.2

Remediation

Patch Available

http://lists.openstack.org/pipermail/openstack-announce/2015-May/000356.html

Event History

May 12, 2015

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

May 13, 2022

Advisory Published

01:26 AM

Frequently Asked Questions

What is the severity of CVE-2015-3646?

CVE-2015-3646 has a high severity level due to the potential exposure of sensitive backend information to authenticated users.

How do I fix CVE-2015-3646?

To fix CVE-2015-3646, upgrade to Keystone version 2014.1.5 or 2014.2.4 or later.

What type of vulnerability is CVE-2015-3646?