CVE-2014-0105: python-keystoneclient context confusion in Keystone auth_token middleware
Summary
CVE-2014-0105: python-keystoneclient vulnerable to context confusion in Keystone auth_token middleware. Affects python-keystoneclient versions < 0.7.0. Fixed in 0.7.0. How to fix ↓
Also tracked for
- keystone · Debian:11
The same CVE-2014-0105 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-keystoneclient is a Python library that provides a client interface for the OpenStack Keystone API. It is commonly used for authentication and authorization in OpenStack deployments. The Keystone auth_token middleware, which is shipped with python-keystoneclient, is responsible for validating authentication tokens and enforcing authorization policies. This vulnerability affects versions of python-keystoneclient prior to 0.7.0.
Vulnerability Detail
A context confusion vulnerability was discovered in the Keystone auth_token middleware. Under certain conditions, an authenticated user could assume the complete identity and multi-tenant authorizations of another authenticated user, potentially leading to privilege escalation. This vulnerability arises from a problematic interaction between eventlet and python-memcached. It is important to note that this vulnerability only affects keystone middleware setups using auth_token with memcache.
How To Fix
Latest published version: 6.0.0 as of 23 Oct 2026
pip install --upgrade "python-keystoneclient==6.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.0
This is the first release that contains the fix.
pip install --upgrade "python-keystoneclient==0.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading python-keystoneclient is not immediately feasible, a possible workaround is to avoid the use of eventlet in conjunction with python-memcached. This can be achieved by ensuring that the calling process already monkey-patches 'thread' to use eventlet. By avoiding this specific interaction, the context confusion vulnerability can be mitigated.
Conclusion
The context confusion vulnerability in python-keystoneclient's Keystone auth_token middleware can allow an authenticated user to assume the identity and authorizations of another user, potentially leading to privilege escalation. It is crucial to upgrade to python-keystoneclient version 0.7.0 or later to mitigate this vulnerability. If immediate upgrading is not possible, avoiding the use of eventlet with python-memcached can provide a temporary workaround. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-keystoneclient →
FAQ
python-keystoneclient is a Python library that provides a client interface for the OpenStack Keystone API. It is commonly used for authentication and authorization in OpenStack deployments.
The Keystone auth_token middleware is a component of python-keystoneclient that validates authentication tokens and enforces authorization policies in OpenStack deployments.
A context confusion vulnerability occurs when an authenticated user is able to assume the identity and authorizations of another authenticated user, potentially leading to privilege escalation.
To fix this vulnerability, it is recommended to upgrade python-keystoneclient to version 0.7.0 or later. This version includes the necessary fixes to address the context confusion issue.
No, only versions prior to 0.7.0 are affected by this vulnerability. It is important to upgrade to the fixed version to ensure the security of your deployment.
Related vulnerabilities
Recent vulnerabilities recorded for python-keystoneclient.
