Information Disclosure Vulnerability in Keystone Package
Summary
CVE-2021-38155: OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). Affects keystone across 2 version ranges.
< 2:18.0.0-3+deb11u1
>= 339e7cc798aed24b7697980eb7cf8e20498d436d, < c65455965aec303b55bc76388314a2b96a2bc12c
Fixed in 2:18.0.0-3+deb11u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Keystone is the identity service used by OpenStack, providing authentication and authorization services for cloud applications. It plays a crucial role in managing users, roles, and permissions within the OpenStack ecosystem. This vulnerability affects Keystone versions 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1, allowing unauthorized actors to confirm the existence of accounts and obtain their UUIDs, potentially leading to further attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2021-38155, arises from the account locking mechanism in Keystone. When an unauthenticated user guesses an account name and fails to authenticate multiple times, the system inadvertently confirms the existence of that account and reveals its UUID. This information can be exploited for unauthorized access or other attacks, particularly in environments where security compliance features are enabled. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2:18.0.0-3+deb11u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade keystoneTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the security_compliance.lockout_failure_attempts feature until the upgrade can be performed. This will prevent the account locking mechanism from confirming account existence during failed authentication attempts.
Conclusion
CVE-2021-38155 represents a significant security risk for OpenStack Keystone deployments, allowing unauthorized users to gain sensitive information about accounts. It is crucial for administrators to upgrade to the fixed versions and consider workarounds to mitigate the risk until the upgrade can be applied.
See every vulnerability recorded for keystone →
FAQ
CVE-2021-38155 is a vulnerability in the Keystone identity service that allows unauthorized users to confirm the existence of accounts and obtain their UUIDs through repeated failed authentication attempts.
Keystone versions 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2021-38155 is 7.5, indicating a high severity level.
Upgrade your Keystone installation to the recommended versions and consider disabling the account lockout feature as a temporary measure until the upgrade is complete.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
