Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.0
CVE-2013-0212: OpenStack Glance may expose Swift credentials in logs
CVE-2013-0212 · published 13 years ago
Summary
When Glance is set to a special Swift configuration and the Swift connection is misconfigured, it writes the Swift username and password in plain text to its log files. Anyone who can read those logs, including remote users with an account, could see the credentials. Update Glance to the latest release (or apply the vendor’s security patch) and ensure log files are only accessible to trusted administrators.
What to do
- Update openstack glance to version 2012.2.3.
- Update debian glance to version 2012.1.1-4.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | openstack | glance |
>= 2012.1, < 2012.2.3 Fix: upgrade to 2012.2.3
|
| – | openstack | image_registry_and_delivery_service_\(glance\) |
2012.1 2012.2 2012.2.1 2012.2.2 cpe:2.3:a:openstack:image_registry_and_delivery_service_\(glance\):2012.1:*:*:*:*:*:*:* |
| – | canonical | ubuntu_linux |
11.10 12.04 12.10 cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:* |
| Debian:12 | debian | glance |
< 2012.1.1-4 Fix: upgrade to 2012.1.1-4
|
| Debian:13 | debian | glance |
< 2012.1.1-4 Fix: upgrade to 2012.1.1-4
|
| Debian:14 | debian | glance |
< 2012.1.1-4 Fix: upgrade to 2012.1.1-4
|
Original advisory text
store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when...
store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-0212
- https://github.com/openstack/glance/commit/37d4d96bf88c2bf3e7e9511b5e321cf4bed36...
- https://github.com/openstack/glance/commit/96a470be64adcef97f235ca96ed3c59ed954a...
- https://github.com/openstack/glance/commit/e96273112b5b5da58d970796b7cfce04c5030...
- https://bugs.launchpad.net/glance/+bug/1098962
- https://bugzilla.redhat.com/show_bug.cgi?id=902964
- https://launchpad.net/glance/+milestone/2012.2.3
- https://lists.launchpad.net/openstack/msg20517.html
- http://rhn.redhat.com/errata/RHSA-2013-0209.html
- http://ubuntu.com/usn/usn-1710-1
- http://www.openwall.com/lists/oss-security/2013/01/29/10
- https://access.redhat.com/errata/RHSA-2013:0209
- https://access.redhat.com/security/cve/CVE-2013-0212
- https://github.com/pypa/advisory-database/tree/main/vulns/glance/PYSEC-2013-37.y...
- https://github.com/advisories/GHSA-xv7j-2v4w-cjvh
- http://secunia.com/advisories/51957 Vendor Advisory
- http://secunia.com/advisories/51990 Vendor Advisory
- https://github.com/openstack/glance Product
- https://security-tracker.debian.org/tracker/CVE-2013-0212 Vendor Advisory
Severity
4.0
Medium
Type
CWE-200Information Exposure
Timeline
Published24 Feb 2013
Updated31 Oct 2026
First seen6 Mar 2026
Sources
GHSA-xv7j-2v4w-cjvh · GHSA
CVE-2013-0212 · NVD
GHSA-xv7j-2v4w-cjvh · OSV
DEBIAN-CVE-2013-0212 · OSV
Track software like this
Free during beta