OpenStack Glance logs user name and password in cleartext

MEDIUM 4.0CVE-2013-0212 · GHSA-xv7j-2v4w-cjvh · PYSEC-2013-37 · Published 24/02/2013 · updated 16/06/2026

Package	Affected versions	Patched versions
glance PyPI	`≥ 2012.1, < 2012.2.3all versions`	`2012.2.3`
image registry and delivery service (glance) openstack	`= 2012.1= 2012.2= 2012.2.1= 2012.2.2`	No fix yet

Description

store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2013-0212 · ADVISORY
openstack/glance commit 37d4d96 · WEB
openstack/glance commit 96a470b · WEB
openstack/glance commit e962731 · WEB
access.redhat.com/errata/RHSA-2013:0209 · WEB
access.redhat.com/security/cve/CVE-2013-0212 · WEB
bugs.launchpad.net/glance/+bug/1098962 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
openstack/glance · PACKAGE
pypa/advisory-database · WEB
launchpad.net/glance/+milestone/2012.2.3 · WEB
lists.launchpad.net/openstack/msg20517.html · WEB
rhn.redhat.com/errata/RHSA-2013-0209.html · WEB
ubuntu.com/usn/usn-1710-1 · WEB
openwall.com/lists/oss-security/2013/01/29/10 · WEB
secunia.com/advisories/51957 · Vendor Advisory
secunia.com/advisories/51990 · Vendor Advisory
GitHub Advisory GHSA-xv7j-2v4w-cjvh · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free