PYSEC-2013-37

Withdrawn 2024-11-22. This finding no longer applies and is kept for reference. It is not used when checking packages.

Quick fix

PYSEC-2013-37 — glance: upgrade to the fixed version with the command below.

pip install --upgrade 'glance>=e96273112b5b5da58d970796b7cfce04c5030a89'

Details

store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/glance

Introduced in: 0Fixed in: e96273112b5b5da58d970796b7cfce04c5030a89

Fixpip install --upgrade 'glance>=e96273112b5b5da58d970796b7cfce04c5030a89'

References

https://bugzilla.redhat.com/show_bug.cgi?id=902964[FIX]
http://www.openwall.com/lists/oss-security/2013/01/29/10[WEB]
https://lists.launchpad.net/openstack/msg20517.html[WEB]
https://github.com/openstack/glance/commit/e96273112b5b5da58d970796b7cfce04c5030a89[FIX]
http://ubuntu.com/usn/usn-1710-1[FIX]
http://secunia.com/advisories/51990[ADVISORY]
https://launchpad.net/glance/+milestone/2012.2.3[WEB]
http://rhn.redhat.com/errata/RHSA-2013-0209.html[ADVISORY]
https://bugs.launchpad.net/glance/+bug/1098962[WEB]
https://github.com/openstack/glance/commit/37d4d96bf88c2bf3e7e9511b5e321cf4bed364b7[FIX]
http://secunia.com/advisories/51957[ADVISORY]
https://github.com/openstack/glance/commit/96a470be64adcef97f235ca96ed3c59ed954a4c1[FIX]
https://github.com/advisories/GHSA-xv7j-2v4w-cjvh[ADVISORY]