Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
openstack keystone vulnerabilities and exploits
(subscribe to this query)
9.8
CVSSv3
CVE-2013-2167
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass
Openstack Python-keystoneclient
Redhat Openstack 3.0
Debian Debian Linux 8.0
Debian Debian Linux 9.0
Debian Debian Linux 10.0
9.8
CVSSv3
CVE-2013-2166
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass
Openstack Python-keystoneclient
Redhat Openstack 3.0
Fedoraproject Fedora 19
Debian Debian Linux 8.0
Debian Debian Linux 9.0
Debian Debian Linux 10.0
8.8
CVSSv3
CVE-2020-12690
An issue exists in OpenStack Keystone prior to 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the ...
Openstack Keystone 16.0.0
Openstack Keystone
8.8
CVSSv3
CVE-2020-12689
An issue exists in OpenStack Keystone prior to 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. Thi...
Openstack Keystone 16.0.0
Openstack Keystone
Canonical Ubuntu Linux 18.04
8.8
CVSSv3
CVE-2020-12691
An issue exists in OpenStack Keystone prior to 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as an...
Openstack Keystone 16.0.0
Openstack Keystone
Canonical Ubuntu Linux 18.04
8.8
CVSSv3
CVE-2019-3683
The keystone-json-assignment package in SUSE Openstack Cloud 8 before commit d7888c75505465490250c00cc0ef4bb1af662f9f every user listed in the /etc/keystone/user-project-map.json was assigned full "member" role access to every project. This allowed these users to access...
Suse Openstack Cloud 8.0
Suse Keystone-json-assignment
Hp Helion Openstack 8.0
8.8
CVSSv3
CVE-2019-19687
OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other user...
Openstack Keystone 15.0.0
Openstack Keystone 16.0.0
8.8
CVSSv3
CVE-2019-10138
A flaw exists in the python-novajoin plugin, all versions up to, excluding 1.1.1, for Red Hat OpenStack Platform. The novajoin API lacked sufficient access control, allowing any keystone authenticated user to generate FreeIPA tokens.
Python Novajoin
7.5
CVSSv3
CVE-2021-38155
OpenStack Keystone 10.x up to and including 16.x prior to 16.0.2, 17.x prior to 17.0.1, 18.x prior to 18.0.1, and 19.x prior to 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticat...
Openstack Keystone
7.5
CVSSv3
CVE-2012-1572
OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space
Openstack Keystone -
Debian Debian Linux 8.0
Debian Debian Linux 9.0
Debian Debian Linux 10.0
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-21991
CVE-2024-32674
path traversal
CVE-2023-21987
denial of service
dos
CVE-2024-4647
CVE-2024-25519
CVE-2024-33612
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
3
4
5
NEXT »