Search CVE reports
11 – 20 of 57 results
CVE-2013-2255
Low priorityHTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.
6 affected packages
cinder, keystone, nova, python-keystoneclient, quantum, swift
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| cinder | — | — | — | — | — |
| keystone | — | — | — | — | — |
| nova | — | — | — | — | — |
| python-keystoneclient | — | — | — | — | — |
| quantum | — | — | — | — | — |
| swift | — | — | — | — | — |
CVE-2018-20170
Low priority** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that...
1 affected packages
keystone
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| keystone | — | — | — | Ignored | Ignored |
CVE-2018-14432
Low priorityIn the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may...
1 affected packages
keystone
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| keystone | — | — | Not affected | Not affected | Not affected |
CVE-2017-2673
Medium prioritySome fixes available 1 of 3
An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted...
1 affected packages
keystone
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| keystone | — | — | — | — | Fixed |
CVE-2016-4911
Medium priorityThe Fernet Token Provider in OpenStack Identity (Keystone) 9.0.x before 9.0.1 (mitaka) allows remote authenticated users to prevent revocation of a chain of tokens and bypass intended access restrictions by rescoping a token.
1 affected packages
keystone
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| keystone | — | — | — | — | Not affected |
CVE-2015-7546
Medium priorityThe identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly...
2 affected packages
keystone, python-keystonemiddleware
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| keystone | — | — | — | — | Not affected |
| python-keystonemiddleware | — | — | — | — | Not affected |
CVE-2015-3646
Medium priorityOpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information...
1 affected packages
keystone
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| keystone | — | — | — | — | — |
CVE-2015-1852
Medium prioritySome fixes available 3 of 5
The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless...
2 affected packages
python-keystoneclient, python-keystonemiddleware
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| python-keystoneclient | — | — | — | — | — |
| python-keystonemiddleware | — | — | — | — | — |
CVE-2014-0204
Medium priorityOpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with...
1 affected packages
keystone
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| keystone | — | — | — | — | — |
CVE-2014-7144
Medium prioritySome fixes available 1 of 3
OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the...
2 affected packages
python-keystoneclient, python-keystonemiddleware
| Package | 24.04 LTS | 22.04 LTS | 20.04 LTS | 18.04 LTS | 16.04 LTS |
|---|---|---|---|---|---|
| python-keystoneclient | — | — | — | — | — |
| python-keystonemiddleware | — | — | — | — | — |