CVE-2013-2167: Insufficient Verification of Data Authenticity in python-keystoneclient
Summary
CVE-2013-2167: Insufficient Verification of Data Authenticity in python-keystoneclient. Affects python-keystoneclient versions >= 0.2.3, < 0.3.0. Fixed in 0.3.0. How to fix ↓
Also tracked for
- python-keystoneclient · Debian:11
The same CVE-2013-2167 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-keystoneclient is a Python library that provides a client interface for the OpenStack Keystone API. It is used for authentication and authorization in OpenStack services. The library allows users to interact with the Keystone service to manage users, roles, and permissions. However, versions 0.2.3 to 0.2.5 of python-keystoneclient are vulnerable to a middleware memcache signing bypass.
Vulnerability Detail
The vulnerability in python-keystoneclient version 0.2.3 to 0.2.5 lies in the insufficient verification of data authenticity in the middleware memcache. This allows an attacker to bypass the signing mechanism and potentially manipulate or access sensitive data. The vulnerability has a severity rating of CRITICAL with a CVSS score of 9.8. The affected functions include keystoneclient.middleware.auth_token.AuthProtocol._protect_cache_value, keystoneclient.middleware.auth_token.AuthProtocol._unprotect_cache_value, and others.
How To Fix
Latest published version: 6.0.0 as of 23 Oct 2026
pip install --upgrade "python-keystoneclient==6.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.3.0
This is the first release that contains the fix.
pip install --upgrade "python-keystoneclient==0.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of python-keystoneclient to ensure the security of the system.
Conclusion
The vulnerability in python-keystoneclient version 0.2.3 to 0.2.5 allows for the bypassing of data authenticity verification in the middleware memcache. This can lead to potential data manipulation or unauthorized access. To mitigate this vulnerability, it is crucial to upgrade to python-keystoneclient version 0.3.0 or above. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-keystoneclient →
FAQ
python-keystoneclient is a Python library used for authentication and authorization in OpenStack services.
Versions 0.2.3 to 0.2.5 of python-keystoneclient are affected by this vulnerability.
This vulnerability has a severity rating of CRITICAL.
The CVSS score of this vulnerability is 9.8.
No, there is no known workaround. It is recommended to upgrade to the fixed version.
Related vulnerabilities
Recent vulnerabilities recorded for python-keystoneclient.
