CVE-2014-0105: OpenStack Python Keystoneclient Auth Token Middleware Privilege Escalation
Summary
CVE-2014-0105: The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain... Affects python-keystoneclient versions < 0.7.0. Fixed in 0.7.0. How to fix ↓
Also tracked for
- keystone · Debian:11
The same CVE-2014-0105 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The OpenStack Python Keystoneclient (python-keystoneclient) is a library used for interacting with the Keystone identity service in OpenStack. It provides authentication and authorization functionalities for OpenStack services. The auth_token middleware in python-keystoneclient before version 0.7.0 is vulnerable to a privilege escalation attack due to improper retrieval of user tokens from memcache. This vulnerability arises from an interaction between eventlet and python-memcached.
Vulnerability Detail
The vulnerability allows remote authenticated users to gain privileges in opportunistic circumstances by sending a large number of requests. The issue lies in the auth_token middleware's handling of user tokens from memcache. By exploiting this vulnerability, an attacker can escalate their privileges and potentially perform unauthorized actions within the OpenStack environment.
How To Fix
Latest published version: 6.0.0 as of 23 Oct 2026
pip install --upgrade "python-keystoneclient==6.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.7.0
This is the first release that contains the fix.
pip install --upgrade "python-keystoneclient==0.7.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The OpenStack Python Keystoneclient library (python-keystoneclient) before version 0.7.0 is vulnerable to a privilege escalation issue in the auth_token middleware. Remote authenticated users can exploit this vulnerability to gain unauthorized privileges within the OpenStack environment. It is recommended to upgrade to python-keystoneclient version 0.7.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-keystoneclient →
FAQ
The vulnerability allows remote authenticated users to gain privileges and potentially perform unauthorized actions within the OpenStack environment.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your Pipfile.lock and it will analyze and alert you in real-time.
There is no known public exploit available for this vulnerability at the time of this report.
The recommended mitigation is to upgrade to python-keystoneclient version 0.7.0 or later, which includes the necessary fixes for this vulnerability.
You can find more information about this vulnerability in the official Python Package Advisory Database: https://github.com/pypa/advisory-database/blob/main/vulns/python-keystoneclient/PYSEC-2014-70.yaml
Related vulnerabilities
Recent vulnerabilities recorded for python-keystoneclient.
