CVE

Id
71912  
CVE No.
CVE-2014-4615  
Status
Candidate  
Description
The notifier middleware in OpenStack PyCADF 0.5.0 and earlier, Telemetry (Ceilometer) 2013.2 before 2013.2.4 and 2014.x before 2014.1.2, Neutron 2014.x before 2014.1.2 and Juno before Juno-2, and Oslo allows remote authenticated users to obtain X_AUTH_TOKEN values by reading the message queue (v2/meters/http.request).  
Phase
Assigned (20140624)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
682376 71912 CVE-2014-4615 MLIST:[oss-security] 20140623 CVE request for vulnerability in OpenStack Neutron, Ceilometer and pyCADF library  View
682377 71912 CVE-2014-4615 URL:http://www.openwall.com/lists/oss-security/2014/06/23/8  View
682378 71912 CVE-2014-4615 MLIST:[oss-security] 20140624 Re: CVE request for vulnerability in OpenStack Neutron, Ceilometer and pyCADF library  View
682379 71912 CVE-2014-4615 URL:http://www.openwall.com/lists/oss-security/2014/06/24/6  View
682380 71912 CVE-2014-4615 MLIST:[oss-security] 20140625 [OSSA 2014-021] User token leak to message queue in pyCADF notifier middleware (CVE-2014-4615)  View
682381 71912 CVE-2014-4615 URL:http://www.openwall.com/lists/oss-security/2014/06/25/6  View
682382 71912 CVE-2014-4615 REDHAT:RHSA-2014:1050  View
682383 71912 CVE-2014-4615 URL:http://rhn.redhat.com/errata/RHSA-2014-1050.html  View
682384 71912 CVE-2014-4615 UBUNTU:USN-2311-1  View
682385 71912 CVE-2014-4615 URL:http://www.ubuntu.com/usn/USN-2311-1  View
682386 71912 CVE-2014-4615 BID:68149  View
682387 71912 CVE-2014-4615 URL:http://www.securityfocus.com/bid/68149  View
682388 71912 CVE-2014-4615 SECUNIA:60643  View
682389 71912 CVE-2014-4615 URL:http://secunia.com/advisories/60643  View
682390 71912 CVE-2014-4615 SECUNIA:60736  View
682391 71912 CVE-2014-4615 URL:http://secunia.com/advisories/60736  View
682392 71912 CVE-2014-4615 SECUNIA:60766  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
16211 JVNDB-2014-005086 Avamar Data Store GEN4(S) および Avamar Virtual Edition の EMC Avamar における平文のパスワードを取得される脆弱性 Avamar Data Store (ADS) GEN4(S) および Avamar Virtual Edition (AVE) の EMC Avamar は、Password Hardening が有効になっている場合、パスワードハッシュに UNIX DES 暗号を使用するため、平文のパスワードを取得される脆弱性が存在します。 CVE-2014-4623 71912 4.3 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-005086.html  View