CVE-2015-3646: OpenStack Keystone Logs Passwords – CVSS 4.0 · Watchpost

← All vulnerabilities

OpenStack Keystone Logs Passwords

MOYENNE 4.0CVE-2015-3646 · GHSA-jwpw-ppj5-7h4w · PYSEC-2026-655 · Published 12/05/2015 · updated 17/06/2026

En bref

CVE-2015-3646 est une vulnérabilité MOYENNE (CVSS 4.0) touchant keystone, keystone (openstack).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.9%, plus élevée que 86.9% des vulnérabilités.
Correctif : mettre à jour vers 2014.1.5, 2014.2.4 ou plus récent.

Package	Affected versions	Patched versions
keystone PyPI	`≥ 2011.3, < 2014.1.5≥ 2014.2, < 2014.2.4`	`2014.1.52014.2.4`
keystone openstack	`≥ 2014.1, < 2014.1.5≥ 2014.2.0, < 2014.2.4`	`2014.1.52014.2.4`

Description

OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.

NVD description

OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.

References

nvd.nist.gov/vuln/detail/CVE-2015-3646 · ADVISORY
bugs.launchpad.net/keystone/+bug/1443598 · WEB
openstack/keystone · PACKAGE
web.archive.org/web/20210122154200/http://www.securityfocus.com/bid/74456 · WEB
lists.openstack.org/pipermail/openstack-announce/2015-May/000356.html · WEB
oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html · WEB
securityfocus.com/bid/74456 · Third Party Advisory
pypi.org/project/keystone · PACKAGE
GitHub Advisory GHSA-jwpw-ppj5-7h4w · ADVISORY

Autres vulnérabilités de keystone

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free