PyPI/keystone CVE-2018-20170: medium 5.3, EPSS 1.12%

** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the

Action: Upgrade keystone to 14.1.0 or later.

pip install keystone==14.1.0

Affected

introduced	fixed	last affected
0	14.1.0	-

Fixed versions

14.1.0

Sources

osv: PYSEC-2018-9
nvd: CVE-2018-20170
https://bugs.launchpad.net/keystone/+bug/1795800

CVE-2018-20170 · published 2018-12-17T07:29:00Z · modified 2023-11-08T04:00:11.214462Z · JSON