CVE-2015-3646
Fixed in a distro release EPSS 3%
OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.
Products: openstack keystone, oracle solaris
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | keystone | 2014.1.5 |
| PyPI | keystone | 2014.2.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | keystone | 2015.1.0-1 |
| Debian 13 | keystone | 2015.1.0-1 |
| Debian 14 | keystone | 2015.1.0-1 |
| SUSE OpenStack Cloud 5 | openstack-keystone | 2014.2.4.juno-17.1 |
| SUSE OpenStack Cloud 5 | openstack-keystone-doc | 2014.2.4.juno-17.2 |
| SUSE OpenStack Cloud 5 | openstack-nova | 2014.2.4.juno-29.1 |
| SUSE OpenStack Cloud 5 | openstack-nova-doc | 2014.2.4.juno-29.1 |
| SUSE OpenStack Cloud 5 | openstack-swift | 2.1.0-14.1 |
| SUSE OpenStack Cloud 5 | openstack-swift-doc | 2.1.0-14.1 |