Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.0
CVE-2014-3621: OpenStack Keystone allows authenticated users to read sensitive config
CVE-2014-3621 · published 12 years ago
Summary
A security flaw in older versions of OpenStack Keystone allows authenticated users to access sensitive configuration settings. This could allow unauthorized access to internal settings, potentially compromising the security of your OpenStack deployment. Update to a patched version or apply a fix to prevent this issue.
What to do
- Update openstack keystone to version 8.0.0a0.
- Update debian keystone to version 2014.1.3-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| pip | openstack | keystone |
< 8.0.0a0 Fix: upgrade to 8.0.0a0
|
| – | openstack | keystone |
>= 2013.2, < 2013.2.3 >= 2014.1, < 2014.1.2.1 cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:* |
| – | canonical | ubuntu_linux |
14.04 cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* |
| – | redhat | openstack |
5.0 4.0 cpe:2.3:a:redhat:openstack:5.0:*:*:*:*:*:*:* |
| Debian:11 | debian | keystone |
< 2014.1.3-1 Fix: upgrade to 2014.1.3-1
|
| Debian:12 | debian | keystone |
< 2014.1.3-1 Fix: upgrade to 2014.1.3-1
|
| Debian:13 | debian | keystone |
< 2014.1.3-1 Fix: upgrade to 2014.1.3-1
|
| Debian:14 | debian | keystone |
< 2014.1.3-1 Fix: upgrade to 2014.1.3-1
|
Original advisory text
The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted end...
The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.
References
- https://nvd.nist.gov/vuln/detail/CVE-2014-3621
- https://bugs.launchpad.net/keystone/+bug/1354208
- http://rhn.redhat.com/errata/RHSA-2014-1688.html
- http://rhn.redhat.com/errata/RHSA-2014-1789.html
- http://rhn.redhat.com/errata/RHSA-2014-1790.html
- http://www.openwall.com/lists/oss-security/2014/09/16/10
- http://www.ubuntu.com/usn/USN-2406-1
- https://access.redhat.com/errata/RHSA-2014:1688
- https://access.redhat.com/errata/RHSA-2014:1789
- https://access.redhat.com/errata/RHSA-2014:1790
- https://access.redhat.com/security/cve/CVE-2014-3621
- https://bugzilla.redhat.com/show_bug.cgi?id=1139937
- https://github.com/openstack/keystone/commit/2989ff257e4fde6a168e25b926805e70040...
- https://github.com/openstack/keystone/commit/52714633c9a4dae5e60279217090859aa6d...
- https://github.com/advisories/GHSA-8v8f-vc72-pmhc
- https://security-tracker.debian.org/tracker/CVE-2014-3621 Vendor Advisory
Severity
4.0
Medium
Type
CWE-200Information Exposure
Timeline
Published2 Oct 2014
Updated4 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta