CVE-2013-2166: python-keystoneclient Memcache Encryption Bypass
Summary
CVE-2013-2166: python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass. Affects python-keystoneclient versions >= 0.2.3, < 0.3.0. Fixed in 0.3.0. How to fix ↓
Also tracked for
- python-keystoneclient · Debian:11
The same CVE-2013-2166 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The python-keystoneclient is a Python library that provides a client interface for the OpenStack Keystone API. It is used for authentication and authorization in OpenStack services. The library allows users to interact with the Keystone service to manage users, roles, and other resources. This vulnerability affects python-keystoneclient versions 0.2.3 to 0.2.5.
Vulnerability Detail
The vulnerability in python-keystoneclient version 0.2.3 to 0.2.5 allows for an encryption bypass in the middleware memcache. This can lead to unauthorized access to sensitive information stored in the memcache, potentially compromising the security of the system. The issue originates from a flaw in the encryption implementation, which allows an attacker to bypass the encryption and gain access to the data.
How To Fix
Minimum fixed version
0.3.0
This is the first release that contains the fix.
pip install --upgrade "python-keystoneclient==0.3.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to a patched version of python-keystoneclient.
Conclusion
The python-keystoneclient library version 0.2.3 to 0.2.5 is vulnerable to an encryption bypass issue in the middleware memcache. This can lead to unauthorized access to sensitive information. It is crucial to upgrade to version 0.3.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for python-keystoneclient →
FAQ
Python-keystoneclient is a Python library used for authentication and authorization in OpenStack services. It provides a client interface for the OpenStack Keystone API.
Versions 0.2.3 to 0.2.5 of python-keystoneclient are affected by this vulnerability.
This vulnerability allows for an encryption bypass in the middleware memcache, potentially leading to unauthorized access to sensitive information stored in the memcache.
No, there is no known workaround for this vulnerability. It is recommended to upgrade to a patched version of python-keystoneclient.
To fix this vulnerability, upgrade python-keystoneclient to version 0.3.0 or later by running the command: pip install --upgrade python-keystoneclient
Related vulnerabilities
Recent vulnerabilities recorded for python-keystoneclient.
