CVE-2014-1948
OpenStack Glance sensitive information disclosure via logs
OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.
Exploit likelihood
What each source reports
NVD Score used
OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.
- Record
CVE-2014-1948- CVSS 2.0
- 2.6 Low
AV:L/AC:H/Au:N/C:P/I:P/A:N - Weakness
- CWE-255
- Updated
- 2026-11-02
CVE ListNo score
OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.
- Record
CVE-2014-1948- Updated
- 2026-11-02
EUVDEUVD-2014-0105No score
OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.
- Record
EUVD-2014-0105- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4xw6-hj5p-4j79
OpenStack Glance sensitive information disclosure via logs
OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.
- Record
GHSA-4xw6-hj5p-4j79- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSVGHSA-4xw6-hj5p-4j79
OpenStack Glance sensitive information disclosure via logs
OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.
- Record
GHSA-4xw6-hj5p-4j79- CVSS 4.0
- 5.1 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 6.2 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSVNo score
OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.
- Record
CVE-2014-1948- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-1948No score
OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.
- Record
DEBIAN-CVE-2014-1948- Updated
- 2026-11-02
OSVPYSEC-2014-102No score
OpenStack Image Registry and Delivery Service (Glance) 2013.2 through 2013.2.1 and Icehouse before icehouse-2 logs a URL containing the Swift store backend password when authentication fails and WARNING level logging is enabled, which allows local users to obtain sensitive information by reading the log.
- Record
PYSEC-2014-102- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
glancePyPI | before 11.0.0a0 | 11.0.0a0 |
glanceDebian:12 | before 2013.2.2-1 | 2013.2.2-1 |
glanceDebian:13 | before 2013.2.2-1 | 2013.2.2-1 |
glanceDebian:14 | before 2013.2.2-1 | 2013.2.2-1 |
openstack-glanceRed Hat:openstack:4::el6 | before 0:2013.2.2-2.el6ost | 0:2013.2.2-2.el6ost |
openstack-glance-docRed Hat:openstack:4::el6 | before 0:2013.2.2-2.el6ost | 0:2013.2.2-2.el6ost |
python-glanceRed Hat:openstack:4::el6 | before 0:2013.2.2-2.el6ost | 0:2013.2.2-2.el6ost |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-1948 is a low vulnerability (CVSS 2.6) in Openstack Image Registry And Delivery Service \(glance\), published February 14, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. Fixed in glance 11.0.0a0.
References
bugs.launchpad.net/glance/+bug/1275062
secunia.com/advisories/56419
rhn.redhat.com/errata/RHSA-2014-0229.html
securityfocus.com/bid/65507
openwall.com/lists/oss-security/2014/02/12/18
nvd.nist.gov/vuln/detail/CVE-2014-1948
Show 13 moreShow less
github.com/openstack/glance/commit/108f0e04ad2ed3dc287f1b71b987a7e9d66072ba
security-tracker.debian.org/tracker/CVE-2014-1948
access.redhat.com/errata/RHSA-2014:0229
bugzilla.redhat.com/show_bug.cgi?id=1064589
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0229.json
cve.org/CVERecord?id=CVE-2014-1948