OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NOpenstack Keystone
APPOpenstack10.0.0 – 16.0.2 (bez)17.0.0 – 17.0.1 (bez)18.0.0 – 18.0.1 (bez)19.0.0 – 19.0.1 (bez)
Powiązane podatności
An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the ca...
A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified all...
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAu...
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an ...
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limit...