CVE-2013-6384

NameCVE-2013-6384
Description(1) impl_db2.py and (2) impl_mongodb.py in OpenStack Ceilometer 2013.2 and earlier, when the logging level is set to INFO, logs the connection string from ceilometer.conf, which allows local users to obtain sensitive information (the DB2 or MongoDB password) by reading the log file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitylow
Debian Bugs730227

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
ceilometer (PTS)jessie2014.1.3-6fixed
stretch1:7.0.1-5fixed
buster1:11.0.1-5fixed
bullseye, sid1:13.0.0-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
ceilometersource(unstable)2013.2-4730227

Search for package or bug name: Reporting problems