CVE-2021-3563: Keystone Application Secret Verification Bypass Vulnerability
Summary
CVE-2021-3563: Openstack Keystone Incorrect Authorization vulnerability. Affects keystone versions < 21.0.0. No fix is published. How to fix ↓
Also tracked for
- keystone · Debian:11
The same CVE-2021-3563 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenStack Keystone is an identity service used for authentication and authorization in cloud environments. It provides a central point for managing users, roles, and permissions across various services. Keystone is crucial for ensuring secure access to cloud resources. However, it has been found to have a vulnerability that compromises its password complexity enforcement.
Vulnerability Detail
A flaw exists in OpenStack Keystone where only the first 72 characters of an application secret are verified. This allows attackers to bypass password complexity requirements that administrators may rely on for securing sensitive data. The vulnerability poses a significant threat to data confidentiality and integrity, as it could enable unauthorized access to protected resources.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, administrators can enforce stricter password policies outside of Keystone to mitigate the risk until the package is updated. This may include implementing additional checks in application logic or using external authentication mechanisms.
Conclusion
The CVE-2021-3563 vulnerability in OpenStack Keystone poses a serious risk to applications relying on this identity service. It is essential to update to the patched version to ensure the security of your data and resources. Utilize tools like Vulert for ongoing monitoring of vulnerabilities in your software.
See every vulnerability recorded for keystone →
FAQ
CVE-2021-3563 is a vulnerability in OpenStack Keystone that allows attackers to bypass password complexity requirements due to insufficient verification of application secrets.
This vulnerability can lead to unauthorized access to sensitive data and resources, compromising data confidentiality and integrity.
If you are using Keystone, it is crucial to update to the latest version that addresses this vulnerability. Follow the instructions in the 'how to fix' section.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. You can check if your application is affected by visiting the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 9.1, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
