The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the
    --password argument, which allows local users to obtain sensitive information by listing the process.
    (CVE-2013-2013)

This update of python-keystoneclient fixes a security vulnerability.

  - Add CVE-2013-2013.patch: allow secure user password     update (CVE-2013-2013, bnc#817415).

New glibc packages are available for Slackware 13.0, 13.1, 13.37, 14.0, and -current to fix security issues.

Allow secure user password update. (CVE-2013-2013)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
432911	SCA: security update for python-keystoneclient (GHSA-8q2m-pwxf-jc7g)	Tenable Cloud Security	SCA Checks	Local	low
432911	SCA: security update for python-keystoneclient (GHSA-8q2m-pwxf-jc7g)	Tenable Self-Hosted Container Security	SCA Checks	Local	low
75064	openSUSE Security Update : python-keystoneclient (openSUSE-SU-2013:1090-1)	Nessus	SuSE Local Security Checks	Local	low
69935	Slackware 13.0 / 13.1 / 13.37 / 14.0 / current : glibc (SSA:2013-260-01)	Nessus	Slackware Local Security Checks	Local	low
69403	Fedora 18 : python-keystoneclient-0.2.0-2.fc18 (2013-13900)	Nessus	Fedora Local Security Checks	Local	low

Detections

Analytics

CVE-2013-2013

medium

Tenable Plugins

low

low

low

low

low