Debian Keystone vulnerabilities

CVE-2020-12691 [HIGH] CVE-2020-12691: keystone - An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any aut... An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a pro

CVE-2020-12690 [HIGH] CVE-2020-12690: keystone - An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The lis... An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments

CVE-2019-19687 [HIGH] CVE-2019-19687: keystone - OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list cre... OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One T

CVE-2020-12689 [HIGH] CVE-2020-12689: keystone - An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any use... An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another us

CVE-2021-38155 [HIGH] CVE-2021-38155: keystone - OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x bef... OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's

CVE-2021-3563 [HIGH] CVE-2021-3563: keystone - A flaw was found in openstack-keystone. Only the first 72 characters of an appli... A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. Scope: local bookworm: open bullseye: open forky: resolved (fixed in 2:23.0.0-3) sid:

CVE-2015-7546 [HIGH] CVE-2015-7546: keystone - The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and... The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers, which allows remote authenticated users to bypass intended acces

CVE-2025-65073 [HIGH] CVE-2025-65073: keystone - OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /... OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization. Scope: local bookworm: resolved (fixed in 2:22.0.2-0+deb12u1) bullseye: resolved (fixed in 2:18.1.0-1+deb11u2) forky: resolved (fixed in 2:28.0.0-2) sid: resolved (fixed in 2:28.0.0-2) trixie: resolved (fi

CVE-2012-4456 [HIGH] CVE-2012-4456: keystone - The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before... The (1) OS-KSADM/services and (2) tenant APIs in OpenStack Keystone Essex before 2012.1.2 and Folsom before folsom-2 do not properly validate X-Auth-Token, which allow remote attackers to read the roles for an arbitrary user or get, create, or delete arbitrary services. Scope: local bookworm: resolved (fixed in 2012.1.1-9) bullseye: resolved (fixed in 2012.1.1-9) for

CVE-2014-2828 [HIGH] CVE-2014-2828: keystone - The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse ... The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication method in a request, aka "authentication chaining." Scope: local bookworm: resolved (fixed in 2014.1-1) bullseye: resolved (fixed in 2014.1-1) forky: re

CVE-2017-2673 [MEDIUM] CVE-2017-2673: keystone - An authorization-check flaw was discovered in federation configurations of the O... An authorization-check flaw was discovered in federation configurations of the OpenStack Identity service (keystone). An authenticated federated user could request permissions to a project and unintentionally be granted all related roles including administrative roles. Scope: local bookworm: resolved (fixed in 2:10.0.0-9) bullseye: resolved (fixed in 2:10.0.0-9) fo

CVE-2013-2059 [MEDIUM] CVE-2013-2059: keystone - OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1... OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows remote authenticated users to retain access via the token. Scope: local bookworm: resolved (fixed in 2013.1.1-2) bullseye: resolved (fixed in 2013.1.1-2) fo

CVE-2012-1572 [HIGH] CVE-2012-1572: keystone - OpenStack Keystone: extremely long passwords can crash Keystone by exhausting st... OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space Scope: local bookworm: resolved (fixed in 2012.1~rc2-1) bullseye: resolved (fixed in 2012.1~rc2-1) forky: resolved (fixed in 2012.1~rc2-1) sid: resolved (fixed in 2012.1~rc2-1) trixie: resolved (fixed in 2012.1~rc2-1)

CVE-2014-3520 [MEDIUM] CVE-2014-3520: keystone - OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno ... OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the project ID in a V2 API trust token request. Scope: local bookworm: resolved (fixed in 2014.1.1-3) bullseye: resolved (fixed in 2014.1.1-3) forky:

CVE-2013-4222 [MEDIUM] CVE-2013-4222: keystone - OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana b... OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token. Scope: local bookworm: resolved (fixed in 2013.1.3-1) bullseye: resolved (fixed in 2013.1.3-1) forky: resolved (fixed in 2013.1.3-1) sid

CVE-2013-6391 [MEDIUM] CVE-2013-6391: keystone - The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Ic... The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request. Scope: local bookworm: resolved (fixed in 2013.2.1-1

CVE-2013-0270 [MEDIUM] CVE-2013-0270: keystone - A flaw was found in OpenStack Keystone. A remote attacker could exploit this vul... A flaw was found in OpenStack Keystone. A remote attacker could exploit this vulnerability by sending a large HTTP request, specifically by providing a long tenant name when requesting a token. This could lead to a denial of service, consuming excessive CPU and memory resources on the affected system. Scope: local bookworm: resolved (fixed in 2013.1.1-2) bullseye:

CVE-2013-1665 [MEDIUM] CVE-2013-1665: keystone - The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenSt... The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack. Scope: local bookworm: resolved (fixed in 2012.1.1-1

CVE-2013-2157 [MEDIUM] CVE-2013-2157: keystone - OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP ... OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password. Scope: local bookworm: resolved (fixed in 2013.1.2-1) bullseye: resolved (fixed in 2013.1.2-1) forky: resolved (fixed in 2013.1.2-1) sid: resolved (fixed in 2013.1.2-1) trixie: resolved (fixe

CVE-2018-14432 [MEDIUM] CVE-2018-14432: keystone - In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.... In the Federation component of OpenStack Keystone before 11.0.4, 12.0.0, and 13.0.0, an authenticated "GET /v3/OS-FEDERATION/projects" request may bypass intended access restrictions on listing projects. An authenticated user may discover projects they have no authority to access, leaking all projects in the deployment and their attributes. Only Keystone with the