{"id":"CVE-2015-3646","aliases":["DEBIAN-CVE-2015-3646","EUVD-2022-4448","GHSA-jwpw-ppj5-7h4w","PYSEC-2026-655","SUSE-SU-2016:2325-1","UBUNTU-CVE-2015-3646"],"status":"published","title":"OpenStack Keystone Logs Passwords","description":"OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0288,"percentile":0.86941,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2015-05-12T19:00:00Z","modified":"2026-09-09T06:47:22Z","fixes":[{"ecosystem":"PyPI","package":"keystone","fixed_in":["2014.2.4","2014.1.5"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"keystone","fixed_in":["2015.1.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"keystone","fixed_in":["2015.1.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"keystone","fixed_in":["2015.1.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2014.2"},{"fixed":"2014.2.4"}]}]},{"source":"ghsa","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2011.3"},{"fixed":"2014.1.5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.1.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.1.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2015.1.0-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2011.3"},{"fixed":"2014.1.5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2014.2"},{"fixed":"2014.2.4"}]}]},{"source":"osv","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2011.3"},{"fixed":"2014.1.5"},{"introduced":"2014.2"},{"fixed":"2014.2.4"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.2.4.juno-17.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-keystone-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.2.4.juno-17.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-nova","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.2.4.juno-29.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-nova-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2014.2.4.juno-29.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-swift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"openstack-swift-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-14.1"}]}],"bundled":2}],"products":[{"vendor":"openstack","product":"keystone"},{"vendor":"oracle","product":"solaris"}],"references":[{"url":"http://lists.openstack.org/pipermail/openstack-announce/2015-May/000356.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Vendor Advisory","advisory","article","fix","web","report"]},{"url":"http://www.securityfocus.com/bid/74456","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://bugs.launchpad.net/keystone/+bug/1443598","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3646","tags":["advisory"]},{"url":"https://web.archive.org/web/20210122154200/http://www.securityfocus.com/bid/74456","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jwpw-ppj5-7h4w","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3646","tags":["advisory"]},{"url":"https://github.com/openstack/keystone","tags":["package"]},{"url":"https://pypi.org/project/keystone","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20162325-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/929628","tags":["report"]},{"url":"https://bugzilla.suse.com/960015","tags":["report"]},{"url":"https://bugzilla.suse.com/960601","tags":["report"]},{"url":"https://bugzilla.suse.com/967356","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3646","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7548","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-3646","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/05/04/10","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3646","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-3646","description":"OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.","status":"published","published":"2015-05-12T19:00:00Z","modified":"2024-08-06T05:47:58.237Z","updated_at":"2026-11-02T14:35:41.976732Z"}],"euvd":[{"id":"EUVD-2022-4448","description":"OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.","status":"published","published":"2015-05-12T19:00:00Z","modified":"2024-08-06T05:47:58Z","updated_at":"2026-11-03T02:22:07.516949Z"}],"ghsa":[{"id":"GHSA-jwpw-ppj5-7h4w","title":"OpenStack Keystone Logs Passwords","description":"OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.","status":"published","published":"2022-05-13T01:26:10Z","modified":"2023-12-07T19:44:24Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:24.593982Z"}],"nvd":[{"id":"CVE-2015-3646","description":"OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.","status":"published","published":"2015-05-12T19:59:26.263Z","modified":"2026-06-17T00:26:02.23Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:04.095849Z"}],"osv":[{"id":"CVE-2015-3646","description":"OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.","status":"published","published":"2015-05-12T19:59:26Z","modified":"2026-07-06T08:11:30.139693944Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3646","description":"OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.","status":"published","published":"2015-05-12T19:59:26.263Z","modified":"2026-09-09T06:47:22.868795057Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"GHSA-jwpw-ppj5-7h4w","title":"OpenStack Keystone Logs Passwords","description":"OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.","status":"published","published":"2022-05-13T01:26:10Z","modified":"2026-07-06T08:11:30.139693944Z","cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:51.10002Z"},{"id":"PYSEC-2026-655","title":"OpenStack Keystone Logs Passwords","description":"OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.","status":"published","published":"2026-07-02T14:13:23.853843Z","modified":"2026-07-06T08:00:47.57874453Z","updated_at":"2026-11-02T15:52:57.671918Z"},{"id":"SUSE-SU-2016:2325-1","title":"Security update for openstack-keystone, openstack-nova, and openstack-swift","description":"\nThis update for openstack-keystone, openstack-nova, and openstack-swift fixes the following issues: \n\n- Fix hybrid backend from keystone v3 (bsc#967356)\n- Fix cleanup when block migration fails (bsc#960015)\n- Avoid host data leak (bsc#960601, CVE-2015-7548)\n- Fix init script for openstack-swift-object-expirer\n- Mark backend_argument as secret (bsc#929628, CVE-2015-3646)\n        \n","status":"published","published":"2016-09-16T12:10:42Z","modified":"2026-02-04T03:46:45.725186Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"UBUNTU-CVE-2015-3646","description":"OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.","status":"withdrawn","published":"2015-05-12T19:59:00Z","modified":"2025-07-16T07:32:56.59054Z","updated_at":"2026-11-02T15:54:10.045446Z"}]}}