6.5Media
CVE-2013-1840Openstack glance: swift: s3: openstack glance: information disclosure of backend credentials via cached image request
Descripción
A flaw was found in OpenStack Glance. Remote authenticated users can exploit this vulnerability by requesting a cached image when the single-tenant Swift or S3 store is in use. This action causes the system to report the location field, which can lead to the disclosure of the operator's backend credentials.
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| openstack | 2 | — | |
| openstack | glance | v1 | |
| Red Hat | OpenStack Folsom for RHEL 6 | all versions | |
| Red Hat | Red Hat OpenStack Platform 16.2 | — | |
| Red Hat | Red Hat OpenStack Platform 17.1 | — | |
| Red Hat | Red Hat OpenStack Platform 18.0 | — |
Referencias y parches
- http://osvdb.org/91304
- http://rhn.redhat.com/errata/RHSA-2013-0707.html
- http://secunia.com/advisories/52565 Vendor Advisory
- http://www.openwall.com/lists/oss-security/2013/03/14/15
- http://www.securityfocus.com/bid/58490
- http://www.ubuntu.com/usn/USN-1764-1
- RHSA-2013:0707 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2013-1840 vdb-entry
- https://bugs.launchpad.net/glance/+bug/1135541
- https://exchange.xforce.ibmcloud.com/vulnerabilities/82878
- https://review.openstack.org/#/c/24437/
- https://review.openstack.org/#/c/24438/
- https://review.openstack.org/#/c/24439/
Coincidencias CPE (NVD) (1)
cpe:2.3:a:openstack:glance:v1:*:*:*:*:*:*:*