GitHub Advisoryadvisory · PyPI
GHSA-cc99-whm5-mmq3 Openstack Keystone Incorrect Authorization vulnerability
CRITICAL
Official page ↗
- Aliases
- CVE-2021-3563
- Ecosystem
- PyPI
- Packages
- keystone
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Weaknesses
- CWE-863
- Reviewed
- 2022-09-16
Affected packages
• PyPI keystone: <= 21.0.0 (no fix yet)
Description
A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A patch is available.
Related
Alias · CVE (1)
- CVE-2021-3563 A flaw was found in openstack-keystone. vulnerability
Weakness · CWE (1)
- CWE-863 Incorrect Authorization weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-3563 advisory
- https://access.redhat.com/security/cve/CVE-2021-3563 web
- https://bugs.launchpad.net/ossa/+bug/1901891 web
- https://bugzilla.redhat.com/show_bug.cgi?id=1962908 web
- https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2026-370.yaml web
- https://lists.debian.org/debian-lts-announce/2024/01/msg00007.html web
- https://opendev.org/openstack/keystone package
- https://opendev.org/openstack/keystone/commit/7859ed26003858ebfd9a5e866b43f1a6a9e83dca web
- https://pypi.org/project/keystone web
- https://review.opendev.org/c/openstack/keystone/+/803641 web
- https://review.opendev.org/c/openstack/keystone/+/828595 web
- https://review.opendev.org/c/openstack/keystone/+/856489 web
- https://security-tracker.debian.org/tracker/CVE-2021-3563 web