OpenStack Glance sensitive information disclosure via logs

BASSO 2.6CVE-2014-1948 · GHSA-4xw6-hj5p-4j79 · PYSEC-2014-102 · Published 14/02/2014 · updated 17/06/2026

Package	Affected versions	Patched versions
glance PyPI	`< 11.0.0a0`	`11.0.0a0`
image registry and delivery service (glance) openstack	`= 2013.2= 2013.2.1`	No fix yet

Description

OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2014-1948 · ADVISORY
openstack/glance commit 108f0e0 · WEB
openstack/glance commit f6e41e9 · WEB
bugs.launchpad.net/glance/+bug/1275062 · WEB
openstack/glance · PACKAGE
pypa/advisory-database · WEB
rhn.redhat.com/errata/RHSA-2014-0229.html · WEB
openwall.com/lists/oss-security/2014/02/12/18 · WEB
secunia.com/advisories/56419
securityfocus.com/bid/65507

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free