CVE-2014-1948

Publication date 14 February 2014

Last updated 24 July 2024

Ubuntu priority

Description

OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
glance	13.10 saucy	Not affected
	12.10 quantal	Not affected
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Not in release

How can I get the fixes?
What do statuses mean?
Patch details

Notes

mdeslaur

OSSA 2014-004

jdstrand

Ubuntu 13.10 (OpenStack Havana) only

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
glance	Other: https://review.openstack.org/72473

References

MITRE
NVD
Launchpad
Debian

Other references

http://www.openwall.com/lists/oss-security/2014/02/12/18
http://lists.openstack.org/pipermail/openstack-announce/2014-February/000194.html
https://www.cve.org/CVERecord?id=CVE-2014-1948