id: PYSEC-2013-24
details: The user-password-update command in python-keystoneclient before 0.2.4 accepts
  the new password in the --password argument, which allows local users to obtain
  sensitive information by listing the process.
affected:
- package:
    name: python-keystoneclient
    ecosystem: PyPI
    purl: pkg:pypi/python-keystoneclient
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 0.2.4
  versions:
  - 0.1.1
  - 0.1.2
  - 0.1.3
  - 0.2.0
  - 0.2.1
  - 0.2.2
  - 0.2.3
references:
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2013/05/23/4
- type: WEB
  url: https://bugs.launchpad.net/python-keystoneclient/+bug/938315
- type: WEB
  url: 
    https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16937
- type: ADVISORY
  url: https://github.com/advisories/GHSA-8q2m-pwxf-jc7g
aliases:
- CVE-2013-2013
- GHSA-8q2m-pwxf-jc7g
modified: "2021-07-25T23:34:51.897352Z"
published: "2013-10-01T20:55:00Z"