Vulnerability: OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in plaintext, which allows local users to obtain sensitive by reading the log file.
Vulnerability ID: CVE-2013-2006
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/openstack/keystone
Published: 2013-05-21
File: keystone/common/config.py
Commit message: Mark LDAP password and admin_token secret

Add secret=True to LDAP password and admin_token
of keystone configuration.

Fix bug #1172195

Change-Id: I8ef7f705e3f6b374ff427c20eb761892d5146a75
(cherry picked from commit d43e2a51a1ed7adbed3c5ddf001d46bc4a824ae8)
Commit author: Xuhan Peng

Vulnerable version (before fix):
 def configure():     register_cli_str('pydev-debug-host', default=None)     register_cli_int('pydev-debug-port', default=None)      register_str('admin_token', default='ADMIN')     register_str('bind_host', default='0.0.0.0')     register_int('compute_port', default=8774)     register_int('admin_port', default=35357) def configure():     # ldap     register_str('url', group='ldap', default='ldap://localhost')     register_str('user', group='ldap', default=None)     register_str('password', group='ldap', default=None)     register_str('suffix', group='ldap', default='cn=example,cn=com')     register_bool('use_dumb_member', group='ldap', default=False)     register_str('dumb_member', group='ldap', default='cn=dumb,dc=nonexistent')

Fixed version (after fix):
 def configure():     register_cli_str('pydev-debug-host', default=None)     register_cli_int('pydev-debug-port', default=None)      register_str('admin_token', secret=True, default='ADMIN')     register_str('bind_host', default='0.0.0.0')     register_int('compute_port', default=8774)     register_int('admin_port', default=35357) def configure():     # ldap     register_str('url', group='ldap', default='ldap://localhost')     register_str('user', group='ldap', default=None)     register_str('password', group='ldap', secret=True, default=None)     register_str('suffix', group='ldap', default='cn=example,cn=com')     register_bool('use_dumb_member', group='ldap', default=False)     register_str('dumb_member', group='ldap', default='cn=dumb,dc=nonexistent')

Patch:
patch: @@ -188,7 +188,7 @@ def configure():
     register_cli_str('pydev-debug-host', default=None)
     register_cli_int('pydev-debug-port', default=None)
 
-    register_str('admin_token', default='ADMIN')
+    register_str('admin_token', secret=True, default='ADMIN')
     register_str('bind_host', default='0.0.0.0')
     register_int('compute_port', default=8774)
     register_int('admin_port', default=35357)
@@ -271,7 +271,7 @@ def configure():
     # ldap
     register_str('url', group='ldap', default='ldap://localhost')
     register_str('user', group='ldap', default=None)
-    register_str('password', group='ldap', default=None)
+    register_str('password', group='ldap', secret=True, default=None)
     register_str('suffix', group='ldap', default='cn=example,cn=com')
     register_bool('use_dumb_member', group='ldap', default=False)
     register_str('dumb_member', group='ldap', default='cn=dumb,dc=nonexistent')
path: keystone/common/config.py