Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
openstack keystone vulnerabilities and exploits
(subscribe to this query)
7.5
CVSSv3
CVE-2015-7546
The identity service in OpenStack Identity (Keystone) prior to 2015.1.3 (Kilo) and 8.0.x prior to 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) prior to 1.5.4 (Kilo) and Liberty prior to 2.3.3 does not properly invalidate authorization tokens when using ...
Openstack Keystonemiddleware
Openstack Keystone
Oracle Solaris 11.3
7.4
CVSSv3
CVE-2021-3563
A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integri...
Openstack Keystone
Debian Debian Linux 10.0
Debian Debian Linux 11.0
Redhat Openstack Platform 16.1
Redhat Openstack Platform 13.0
Redhat Openstack Platform 10.0
Redhat Openstack Platform 16.2
6.6
CVSSv3
CVE-2022-2447
A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected...
Openstack Keystone -
Redhat Storage 3.0
Redhat Quay 3.0.0
Redhat Openstack Platform 16.1
Redhat Openstack Platform 16.2
5.9
CVSSv3
CVE-2013-2255
HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates.
Openstack Compute 2013.1
Openstack Keystone 2013
Redhat Openstack 3.0
Redhat Openstack 4.0
Debian Debian Linux 10.0
Debian Debian Linux 8.0
Debian Debian Linux 9.0
5.4
CVSSv3
CVE-2020-12692
An issue exists in OpenStack Keystone prior to 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.
Openstack Keystone 16.0.0
Openstack Keystone
Canonical Ubuntu Linux 18.04
5.3
CVSSv3
CVE-2018-20170
OpenStack Keystone up to and including 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessaril...
Openstack Keystone
4.3
CVSSv3
CVE-2016-4911
The Fernet Token Provider in OpenStack Identity (Keystone) 9.0.x prior to 9.0.1 (mitaka) allows remote authenticated users to prevent revocation of a chain of tokens and bypass intended access restrictions by rescoping a token.
Keystone Openstack Identity 9.0.0.0
NA
CVE-2015-3646
OpenStack Identity (Keystone) prior to 2014.1.5 and 2014.2.x prior to 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.
Openstack Keystone
Oracle Solaris 11.2
NA
CVE-2014-0204
OpenStack Identity (Keystone) prior to 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, which allows remote authenticated users to gain privileges that are assigned to a group with the same ID.
Openstack Keystone
NA
CVE-2014-7144
OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x prior to 0.11.0 and 1.x prior to 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote maliciou...
Openstack Keystonemiddleware 1.1.0
Openstack Python-keystoneclient
Openstack Keystonemiddleware 1.1.1
Openstack Keystonemiddleware 1.0.0
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
HTML injection
CVE-2024-35894
SQL
CVE-2024-5105
CVE-2014-100005
CVE-2024-35895
unauthorized
CVE-2024-22120
CVE-2024-35890
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
« PREV
1
2
3
4
5
NEXT »