keystone (PyPI)
Advisories
110
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 2014.2.4 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "keystone>=2014.2.4"poetry
poetry add "keystone>=2014.2.4"uv
uv add "keystone>=2014.2.4"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-whqr-fgm5-x77q OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token |
High EPSS 0.25% |
>= 14.0.0, < 27.0.2 | 27.0.2 |
| GHSA-whqr-fgm5-x77q OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token |
High EPSS 0.25% |
>= 29.0.0, < 29.0.2 | 29.0.2 |
| GHSA-whqr-fgm5-x77q OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token |
High EPSS 0.25% |
>= 14.0.0, < 27.0.2>= 28.0.0, < 28.0.2>= 29.0.0, < 29.0.2 | 27.0.228.0.229.0.2 |
| GHSA-whqr-fgm5-x77q OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token |
High EPSS 0.25% |
>= 28.0.0, < 28.0.2 | 28.0.2 |
| GHSA-q623-f4j4-p4xj OpenStack Keystone has an Incorrect Authorization issue |
High EPSS 0.33% |
>= 14.0.0, < 27.0.2>= 28.0.0, < 28.0.2>= 29.0.0, < 29.0.2 | 27.0.228.0.229.0.2 |
| GHSA-q623-f4j4-p4xj OpenStack Keystone has an Incorrect Authorization issue |
High EPSS 0.33% |
>= 29.0.0, < 29.0.2 | 29.0.2 |
| GHSA-q623-f4j4-p4xj OpenStack Keystone has an Incorrect Authorization issue |
High EPSS 0.33% |
>= 14.0.0, < 27.0.2 | 27.0.2 |
| GHSA-q623-f4j4-p4xj OpenStack Keystone has an Incorrect Authorization issue |
High EPSS 0.33% |
>= 28.0.0, < 28.0.2 | 28.0.2 |
| GHSA-2r23-2g6v-2m5f OpenStack Keystone has an Authorization Bypass |
High EPSS 0.33% |
>= 28.0.0, < 28.0.2 | 28.0.2 |
| GHSA-2r23-2g6v-2m5f OpenStack Keystone has an Authorization Bypass |
High EPSS 0.33% |
>= 14.0.0, < 27.0.2 | 27.0.2 |
| GHSA-2r23-2g6v-2m5f OpenStack Keystone has an Authorization Bypass |
High EPSS 0.33% |
>= 29.0.0, < 29.0.2 | 29.0.2 |
| GHSA-2r23-2g6v-2m5f OpenStack Keystone has an Authorization Bypass |
High EPSS 0.33% |
>= 14.0.0, < 27.0.2>= 28.0.0, < 28.0.2>= 29.0.0, < 29.0.2 | 27.0.228.0.229.0.2 |
| GHSA-8f8m-wrvr-wcvf OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential |
High EPSS 0.30% |
>= 14.0.0, < 27.0.2>= 28.0.0, < 28.0.2>= 29.0.0, < 29.0.2 | 27.0.228.0.229.0.2 |
| GHSA-8f8m-wrvr-wcvf OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential |
High EPSS 0.30% |
>= 29.0.0, < 29.0.2 | 29.0.2 |
| GHSA-8f8m-wrvr-wcvf OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential |
High EPSS 0.30% |
>= 28.0.0, < 28.0.2 | 28.0.2 |
| GHSA-8f8m-wrvr-wcvf OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential |
High EPSS 0.30% |
>= 14.0.0, < 27.0.2 | 27.0.2 |
| GHSA-hhq2-3832-xxcv OpenStack Keystone has an Incorrect Authorization Issue |
High EPSS 0.47% |
>= 13.0.0, <= 29.0.1 | No fix yet |
| GHSA-hhq2-3832-xxcv OpenStack Keystone has an Incorrect Authorization Issue |
High EPSS 0.47% |
>= 14.0.0, < 27.0.2>= 28.0.0, < 28.0.2>= 29.0.0, < 29.0.2 | 27.0.228.0.229.0.2 |
| GHSA-pfx2-9x9m-7ghx OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean |
High EPSS 0.34% |
< 28.0.1 | 28.0.1 |
| GHSA-pfx2-9x9m-7ghx OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean |
High EPSS 0.34% |
< 28.0.1 | 28.0.1 |
| GHSA-4phw-6824-6cfp OpenStack Keystone: Restricted application credentials can create EC2 credentials |
Medium EPSS 0.22% |
>= 14.0.0, < 26.1.1 | 26.1.1 |
| GHSA-4phw-6824-6cfp OpenStack Keystone: Restricted application credentials can create EC2 credentials |
Medium EPSS 0.22% |
>= 14.0.0, < 26.1.1 | 26.1.1 |
| GHSA-hcqg-5g63-7j9h OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization. |
High EPSS 0.24% |
< 26.0.1>= 27.0.0.0rc1, < 27.0.0>= 28.0.0.0rc1, < 28.0.0 | 26.0.127.0.028.0.0 |
| GHSA-hcqg-5g63-7j9h OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization. |
High EPSS 0.24% |
>= 28.0.0.0rc1, < 28.0.0 | 28.0.0 |
| GHSA-hcqg-5g63-7j9h OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization. |
High EPSS 0.24% |
>= 27.0.0.0rc1, < 27.0.0 | 27.0.0 |
| GHSA-hcqg-5g63-7j9h OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization. |
High EPSS 0.24% |
< 26.0.1 | 26.0.1 |
| GHSA-cc99-whm5-mmq3 Openstack Keystone Incorrect Authorization vulnerability |
Critical EPSS 1.86% |
<= 21.0.0 | No fix yet |
| GHSA-cc99-whm5-mmq3 Openstack Keystone Incorrect Authorization vulnerability |
Critical EPSS 1.86% |
<= 21.0.0 | No fix yet |
| GHSA-4225-97pr-rr52 OpenStack Keystone allows information disclosure during account locking |
High EPSS 2.48% |
>= 10.0, < 16.0.2 | 16.0.2 |
| GHSA-4225-97pr-rr52 OpenStack Keystone allows information disclosure during account locking |
High EPSS 2.48% |
>= 17.0, < 17.0.1 | 17.0.1 |
| GHSA-4225-97pr-rr52 OpenStack Keystone allows information disclosure during account locking |
High EPSS 2.48% |
>= 10.0, < 16.0.2>= 17.0, < 17.0.1>= 18.0, < 18.0.1>= 19.0, < 19.0.1 | 16.0.217.0.118.0.119.0.1 |
| GHSA-4225-97pr-rr52 OpenStack Keystone allows information disclosure during account locking |
High EPSS 2.48% |
>= 18.0, < 18.0.1 | 18.0.1 |
| GHSA-4225-97pr-rr52 OpenStack Keystone allows information disclosure during account locking |
High EPSS 2.48% |
>= 19.0, < 19.0.1 | 19.0.1 |
| GHSA-f889-wfwm-6p7m OpenStack Identity Keystone Privilege Escalation vulnerability |
Low EPSS 0.45% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-f889-wfwm-6p7m OpenStack Identity Keystone Privilege Escalation vulnerability |
Low EPSS 0.45% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-mrxv-65rv-6hxq OpenStack Keystone does not invalidate existing tokens when granting or revoking roles |
Medium EPSS 1.90% |
< 2012.1.3 | 2012.1.3 |
| GHSA-mrxv-65rv-6hxq OpenStack Keystone does not invalidate existing tokens when granting or revoking roles |
Medium EPSS 1.90% |
< 2012.1.3 | 2012.1.3 |
| GHSA-x8h4-xf47-pqc3 OpenStack Keystone Token authorization for a user in a disabled tenant is allowed |
Medium EPSS 2.29% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-x8h4-xf47-pqc3 OpenStack Keystone Token authorization for a user in a disabled tenant is allowed |
Medium EPSS 2.29% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-mf98-r2gf-2x3w OpenStack Keystone Improper Authentication vulnerability |
High EPSS 4.00% |
>= 2012.1, < 2012.1.2 | 2012.1.2 |
| GHSA-mf98-r2gf-2x3w OpenStack Keystone Improper Authentication vulnerability |
High EPSS 4.00% |
>= 2012.1, < 2012.1.2 | 2012.1.2 |
| GHSA-jwpw-ppj5-7h4w OpenStack Keystone Logs Passwords |
Medium EPSS 2.88% |
>= 2014.2, < 2014.2.4 | 2014.2.4 |
| GHSA-c4p9-87h3-7vr4 OpenStack Identity Keystone Improper Privilege Management |
Medium EPSS 1.40% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-c4p9-87h3-7vr4 OpenStack Identity Keystone Improper Privilege Management |
Medium EPSS 1.40% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-8v8f-vc72-pmhc OpenStack Identity Keystone Exposure of Sensitive Information |
Medium EPSS 2.13% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-8v8f-vc72-pmhc OpenStack Identity Keystone Exposure of Sensitive Information |
Medium EPSS 2.13% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-jwpw-ppj5-7h4w OpenStack Keystone Logs Passwords |
Medium EPSS 2.88% |
>= 2011.3, < 2014.1.5>= 2014.2, < 2014.2.4 | 2014.1.52014.2.4 |
| GHSA-jwpw-ppj5-7h4w OpenStack Keystone Logs Passwords |
Medium EPSS 2.88% |
>= 2011.3, < 2014.1.5 | 2014.1.5 |
| GHSA-7332-36h8-8jh8 OpenStack Identity (Keystone) Denial of Service |
Medium EPSS 3.27% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-7332-36h8-8jh8 OpenStack Identity (Keystone) Denial of Service |
Medium EPSS 3.27% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-274v-r947-v34r OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege |
Medium EPSS 2.33% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-274v-r947-v34r OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege |
Medium EPSS 2.33% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-8833-qrvm-wc3h OpenStack Keystone allows context-dependent attackers to bypass access restrictions |
Medium EPSS 1.76% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-8833-qrvm-wc3h OpenStack Keystone allows context-dependent attackers to bypass access restrictions |
Medium EPSS 1.76% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-4ppj-4p4v-jf4p OpenStack Keystone Denial of Service vulnerability via a large HTTP request |
Medium EPSS 3.16% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-4ppj-4p4v-jf4p OpenStack Keystone Denial of Service vulnerability via a large HTTP request |
Medium EPSS 3.16% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-qh2x-hpf9-cf2g OpenStack Keystone and other components vulnerable to Improper Certificate Validation |
Medium EPSS 0.97% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-qh2x-hpf9-cf2g OpenStack Keystone and other components vulnerable to Improper Certificate Validation |
Medium EPSS 0.97% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-rqw2-hhrf-7936 OpenStack Keystone does not check signature TTL of the EC2 credential auth method |
Medium EPSS 0.70% |
>= 16.0.0.0rc1, < 16.0.0 | 16.0.0 |
| GHSA-rqw2-hhrf-7936 OpenStack Keystone does not check signature TTL of the EC2 credential auth method |
Medium EPSS 0.70% |
< 15.0.1 | 15.0.1 |
| GHSA-6m8p-x4qw-gh5j Insufficient Session Expiration in OpenStack Keystone |
High EPSS 1.90% |
< 15.0.1 | 15.0.1 |
| GHSA-4427-7f3w-mqv6 OpenStack Keystone V3 /credentials endpoint policy logic allows to change credentials owner or target project ID |
High EPSS 4.92% |
< 15.0.1 | 15.0.1 |
| GHSA-4427-7f3w-mqv6 OpenStack Keystone V3 /credentials endpoint policy logic allows to change credentials owner or target project ID |
High EPSS 4.92% |
>= 16.0.0, < 16.0.1 | 16.0.1 |
| GHSA-4427-7f3w-mqv6 OpenStack Keystone V3 /credentials endpoint policy logic allows to change credentials owner or target project ID |
High EPSS 4.92% |
< 15.0.1 | 15.0.1 |
| GHSA-chgw-36xv-47cw OpenStack Keystone EC2 and/or credential endpoints are not protected from a scoped context |
High EPSS 1.56% |
< 15.0.1 | 15.0.1 |
| GHSA-chgw-36xv-47cw OpenStack Keystone EC2 and/or credential endpoints are not protected from a scoped context |
High EPSS 1.56% |
>= 16.0.0, < 16.0.1 | 16.0.1 |
| GHSA-chgw-36xv-47cw OpenStack Keystone EC2 and/or credential endpoints are not protected from a scoped context |
High EPSS 1.56% |
< 15.0.1 | 15.0.1 |
| GHSA-6m8p-x4qw-gh5j Insufficient Session Expiration in OpenStack Keystone |
High EPSS 1.90% |
< 15.0.1 | 15.0.1 |
| GHSA-6m8p-x4qw-gh5j Insufficient Session Expiration in OpenStack Keystone |
High EPSS 1.90% |
>= 16.0.0.0rc1, < 16.0.0 | 16.0.0 |
| GHSA-rqw2-hhrf-7936 OpenStack Keystone does not check signature TTL of the EC2 credential auth method |
Medium EPSS 0.70% |
< 15.0.1 | 15.0.1 |
| PYSEC-2019-99 OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Withdrawn |
Not rated yet | < 16.0.1 | 16.0.1 |
| GHSA-2j23-fwqm-mgwr OpenStack Keystone Credential Leakage |
High EPSS 1.78% |
>= 16.0.0, < 16.0.1 | 16.0.1 |
| GHSA-2j23-fwqm-mgwr OpenStack Keystone Credential Leakage |
High EPSS 1.78% |
>= 15.0.0, < 15.0.1 | 15.0.1 |
| GHSA-2j23-fwqm-mgwr OpenStack Keystone Credential Leakage |
High EPSS 1.78% |
< 16.0.1 | 16.0.1 |
| PYSEC-2018-9 ** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for… |
Not rated yet EPSS 1.12% |
< 14.1.0 | 14.1.0 |
| GHSA-j36m-hv43-7w7m OpenStack Identity service (keystone) Incorrect Authorization |
High EPSS 2.10% |
>= 10.0.0, < 10.0.2 | 10.0.2 |
| GHSA-j36m-hv43-7w7m OpenStack Identity service (keystone) Incorrect Authorization |
High EPSS 2.10% |
>= 9.0.0, <= 9.3.0 | No fix yet |
| GHSA-j36m-hv43-7w7m OpenStack Identity service (keystone) Incorrect Authorization |
High EPSS 2.10% |
>= 11.0.0, < 11.0.1 | 11.0.1 |
| GHSA-j36m-hv43-7w7m OpenStack Identity service (keystone) Incorrect Authorization |
High EPSS 2.10% |
>= 9.0.0, < 10.0.2>= 11.0.0, < 11.0.1 | 10.0.211.0.1 |
| GHSA-f82m-w3p3-cgp3 OpenStack Identity Keystone Improper Access Control |
Medium EPSS 1.40% |
>= 9.0.0, < 9.0.1 | 9.0.1 |
| GHSA-f82m-w3p3-cgp3 OpenStack Identity Keystone Improper Access Control |
Medium EPSS 1.40% |
>= 9.0.0, < 9.0.1 | 9.0.1 |
| GHSA-8c4w-v65p-jvcv OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials |
High EPSS 2.00% |
>= 8.0, < 8.1.0 | 8.1.0 |
| GHSA-8c4w-v65p-jvcv OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials |
High EPSS 2.00% |
>= 8.0, < 8.1.0>= 9.0.0.0b1, < 9.0.0.0b2 | 8.1.09.0.0.0b2 |
| GHSA-8c4w-v65p-jvcv OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials |
High EPSS 2.00% |
>= 9.0.0.0b1, < 9.0.0.0b2 | 9.0.0.0b2 |
| GHSA-gmvp-5rf9-mxcm OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events |
Medium EPSS 1.59% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-v8fq-gq9j-3v7h OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events |
Medium EPSS 1.52% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-v8fq-gq9j-3v7h OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events |
Medium EPSS 1.52% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-77w8-qv8m-386h OpenStack Keystone Domain-scoped tokens don't get revoked |
Medium EPSS 1.49% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-77w8-qv8m-386h OpenStack Keystone Domain-scoped tokens don't get revoked |
Medium EPSS 1.49% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-gmvp-5rf9-mxcm OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events |
Medium EPSS 1.59% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-6mv3-p2gr-wgqf OpenStack Identity (Keystone) DoS through V3 API authentication chaining |
High EPSS 3.22% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-6mv3-p2gr-wgqf OpenStack Identity (Keystone) DoS through V3 API authentication chaining |
High EPSS 3.22% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-23x9-8hxr-978c OpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend |
Medium EPSS 1.37% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-23x9-8hxr-978c OpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend |
Medium EPSS 1.37% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-5qpp-v56f-mqfm OpenStack Identity (Keystone) allows remote attackers to bypass intended access restrictions via revoked PKI token |
Medium EPSS 2.70% |
>= 2012.2.0, < 2013.1.4 | 2013.1.4 |
| GHSA-5qpp-v56f-mqfm OpenStack Identity (Keystone) allows remote attackers to bypass intended access restrictions via revoked PKI token |
Medium EPSS 2.70% |
>= 2012.2.0, < 2013.1.4 | 2013.1.4 |
| GHSA-hj89-qmx9-8qmh OpenStack Identity (Keystone) improper revoking of the authentication token when deleting a user |
Medium EPSS 2.47% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-hj89-qmx9-8qmh OpenStack Identity (Keystone) improper revoking of the authentication token when deleting a user |
Medium EPSS 2.47% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-rxrm-xvp4-jqvh OpenStack Keystone Sensitive information disclosure via log files |
Low EPSS 0.61% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-rxrm-xvp4-jqvh OpenStack Keystone Sensitive information disclosure via log files |
Low EPSS 0.61% |
all versions | No fix yet |
| GHSA-22q6-wwq7-2jj9 OpenStack Keystone Improper Authentication vulnerability |
Medium EPSS 2.63% |
>= 2012.2, < 2012.2.4 | 2012.2.4 |
| GHSA-22q6-wwq7-2jj9 OpenStack Keystone Improper Authentication vulnerability |
Medium EPSS 2.63% |
>= 2012.2, < 2012.2.4 | 2012.2.4 |
| GHSA-qvpr-qm6w-6rcc OpenStack Keystone intended authorization restrictions bypass |
Medium EPSS 2.05% |
all versions | No fix yet |
| GHSA-w66p-78g4-mr7g OpenStack Keystone Insufficient token expiration |
Medium EPSS 2.86% |
all versions | No fix yet |
| GHSA-w66p-78g4-mr7g OpenStack Keystone Insufficient token expiration |
Medium EPSS 2.86% |
< 8.0.0 | 8.0.0 |
| GHSA-qvpr-qm6w-6rcc OpenStack Keystone intended authorization restrictions bypass |
Medium EPSS 2.05% |
< 8.0.0a0 | 8.0.0a0 |
| GHSA-gf2q-j2qq-pjf2 OpenStack Keystone Allows Remote User Account Creation |
High EPSS 2.50% |
all versions | No fix yet |
| GHSA-gf2q-j2qq-pjf2 OpenStack Keystone Allows Remote User Account Creation |
High EPSS 2.50% |
< 2012.1 | 2012.1 |
| GHSA-xp97-6w7r-4cjc OpenStack Keystone token expiration issues |
Medium EPSS 2.30% |
all versions | No fix yet |
| GHSA-xp97-6w7r-4cjc OpenStack Keystone token expiration issues |
Medium EPSS 2.30% |
< 8.0.0a0 | 8.0.0a0 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor