CVE

Id
70917  
CVE No.
CVE-2014-3621  
Status
Candidate  
Description
The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.  
Phase
Assigned (20140514)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
675545 70917 CVE-2014-3621 MLIST:[oss-security] 20140916 [OSSA 2014-029] Configuration option leak through Keystone catalog (CVE-2014-3621)  View
675546 70917 CVE-2014-3621 URL:http://www.openwall.com/lists/oss-security/2014/09/16/10  View
675547 70917 CVE-2014-3621 CONFIRM:https://bugs.launchpad.net/keystone/+bug/1354208  View
675548 70917 CVE-2014-3621 REDHAT:RHSA-2014:1688  View
675549 70917 CVE-2014-3621 URL:http://rhn.redhat.com/errata/RHSA-2014-1688.html  View
675550 70917 CVE-2014-3621 REDHAT:RHSA-2014:1789  View
675551 70917 CVE-2014-3621 URL:http://rhn.redhat.com/errata/RHSA-2014-1789.html  View
675552 70917 CVE-2014-3621 REDHAT:RHSA-2014:1790  View
675553 70917 CVE-2014-3621 URL:http://rhn.redhat.com/errata/RHSA-2014-1790.html  View
675554 70917 CVE-2014-3621 UBUNTU:USN-2406-1  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
16599 JVNDB-2014-005474 Apache Qpid の XML Exchange モジュールにおける XML 外部エンティティの脆弱性 Apache Qpid の XML Exchange モジュールには、XML 外部エンティティ (XXE) の脆弱性が存在します。 CVE-2014-3629 70917 4.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005474.html  View