CVE-2015-3646: OpenStack Keystone Logs Passwords – CVSS 4.0 · Watchpost

← All vulnerabilities

OpenStack Keystone Logs Passwords

MEDIO 4.0CVE-2015-3646 · GHSA-jwpw-ppj5-7h4w · PYSEC-2026-655 · Published 12/05/2015 · updated 17/06/2026

En resumen

CVE-2015-3646 es una vulnerabilidad MEDIO (CVSS 4.0) que afecta a keystone, keystone (openstack).
Probabilidad de explotación en los próximos 30 días (EPSS): 2.9%, mayor que el 86.9% de las vulnerabilidades.
Solución: actualizar a 2014.1.5, 2014.2.4 o posterior.

Package	Affected versions	Patched versions
keystone PyPI	`≥ 2011.3, < 2014.1.5≥ 2014.2, < 2014.2.4`	`2014.1.52014.2.4`
keystone openstack	`≥ 2014.1, < 2014.1.5≥ 2014.2.0, < 2014.2.4`	`2014.1.52014.2.4`

Description

OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.

NVD description

OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.

References

nvd.nist.gov/vuln/detail/CVE-2015-3646 · ADVISORY
bugs.launchpad.net/keystone/+bug/1443598 · WEB
openstack/keystone · PACKAGE
web.archive.org/web/20210122154200/http://www.securityfocus.com/bid/74456 · WEB
lists.openstack.org/pipermail/openstack-announce/2015-May/000356.html · WEB
oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html · WEB
securityfocus.com/bid/74456 · Third Party Advisory
pypi.org/project/keystone · PACKAGE
GitHub Advisory GHSA-jwpw-ppj5-7h4w · ADVISORY

Más vulnerabilidades de keystone

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free