Description
store/swift.py in OpenStack Glance Essex (2012.1), Folsom (2012.2) before 2012.2.3, and Grizzly, when in Swift single tenant mode, logs the Swift endpoint's user name and password in cleartext when the endpoint is misconfigured or unusable, allows remote authenticated users to obtain sensitive information by reading the error messages.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | glance | 2012.1.1-4 | — |
| Debian 13 | glance | 2012.1.1-4 | — |
| Debian 12 | glance | 2012.1.1-4 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 2 | python-glance +2 | 2012.2.1-4.el6ost | RHSA-2013:0209 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 1 repository
-
LogSec/CVE-2013-0212 ★ 0 · Apr 24, 2022
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | glance | >= 2012.1, < 2012.2.3 | 2012.2.3 | GHSA-xv7j-2v4w-cjvh |
Advisories 1
- RHSA-2013:0209 Red Hat Security Advisory: openstack-glance security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
References
- https://github.com/openstack/glance/commit/96a470be64adcef97f235ca96ed3c59ed954a4c1
- [openstack] 20130129 [OSSA 2013-002] Backend password leak in Glance error message (CVE-2013-0212) mailing-list
- USN-1710-1 vendor-advisory
- https://github.com/openstack/glance/commit/37d4d96bf88c2bf3e7e9511b5e321cf4bed364b7
- https://bugs.launchpad.net/glance/+bug/1098962
- https://launchpad.net/glance/+milestone/2012.2.3
- [oss-security] 20130129 [OSSA 2013-002] Backend password leak in Glance error message (CVE-2013-0212) mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=902964
- RHSA-2013:0209 vendor-advisory
- 51990 third-party-advisory
- https://github.com/openstack/glance/commit/e96273112b5b5da58d970796b7cfce04c5030a89
- 51957 third-party-advisory