CVE-2014-3621
02.10.2014, 14:55
The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.Enginsight
| Vendor | Product | Version |
|---|---|---|
| openstack | keystone | 2013.2 ≤ 𝑥 < 2013.2.3 |
| openstack | keystone | 2014.1 ≤ 𝑥 < 2014.1.2.1 |
| canonical | ubuntu_linux | 14.04 |
| redhat | openstack | 5.0 |
| redhat | openstack | 4.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| keystone |
|
Common Weakness Enumeration
References