CVE-2021-3563: Openstack Keystone Incorrect Authorization vulnerability
Summary
CVE-2021-3563: Openstack Keystone Incorrect Authorization vulnerability. Affects keystone versions < 21.0.0. No fix is published. How to fix ↓
Also tracked for
- keystone · Debian:11
The same CVE-2021-3563 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Openstack Keystone is an open-source identity service that provides authentication and authorization for other OpenStack services. It manages user credentials, tokens, and policies to control access to resources. This vulnerability affects versions 0 to 21.0.0 of the keystone package available on PyPI.
Vulnerability Detail
The vulnerability in openstack-keystone allows attackers to bypass password complexity checks by exploiting a flaw in the verification process of application secrets. Specifically, only the first 72 characters of an application secret are verified, enabling attackers to create passwords that appear to meet complexity requirements but are actually easily guessable. This can lead to unauthorized access, compromising data confidentiality and integrity.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided patch or update the keystone package to the latest version.
Conclusion
The Openstack Keystone Incorrect Authorization vulnerability in the keystone package allows attackers to bypass password complexity checks, potentially leading to unauthorized access and compromising data confidentiality and integrity. It is recommended to update the keystone package to version 21.0.1 or later to fix this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for keystone →
FAQ
Openstack Keystone is an open-source identity service that provides authentication and authorization for other OpenStack services.
The vulnerability allows attackers to bypass password complexity checks, potentially leading to unauthorized access and compromising data confidentiality and integrity.
Versions 0 to 21.0.0 of the keystone package available on PyPI are affected.
To fix this vulnerability, update the keystone package to version 21.0.1 or later by running the command 'pip install --upgrade keystone'.
There is no known workaround for this vulnerability. It is crucial to apply the provided patch or update the keystone package to the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for keystone.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
