A flaw was reported [1],[2] in OpenStack Glance 2013.2 versions up to and including 2013.2.1 and is described as follows: Nikhil Komawar from Rackspace reported an information leak in Glance logs. The password for the Swift store backend is logged at WARNING level as part of the URL when authentication to a store fails if image location is not disabled by policy or the store is a single-tenant configuration. An attacker with access to the logs (local shell, log aggregation system access, or accidental leak) may leverage this vulnerability to elevate privileges and gain direct full access to the Glance Swift store backend. Only Glance setups using the Swift store backend are affected. This has been corrected in upstream git [3] and version 2013.2.2. [1] http://seclists.org/oss-sec/2014/q1/323 [2] https://bugs.launchpad.net/glance/+bug/1275062 [3] https://git.openstack.org/cgit/openstack/glance/commit/?id=108f0e04ad2ed3dc287f1b71b987a7e9d66072ba
Created openstack-glance tracking bugs for this issue: Affects: fedora-19 [bug 1064662] Affects: fedora-20 [bug 1064663]
This issue does not affect stable/grizzly. It was introduced in stable/havana as part of the image location work, hence bz #1064662 should be closed.
This issue has been addressed in following products: OpenStack 4 for RHEL 6 Via RHSA-2014:0229 https://rhn.redhat.com/errata/RHSA-2014-0229.html
openstack-glance-2013.2.3-3.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.