CVE-2018-20170
1 advisory.
PyPI/keystone CVE-2018-20170: unknown
** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the
Action: Upgrade keystone to 14.1.0 or later.
pip install keystone==14.1.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 14.1.0 | - |
Fixed versions
| 14.1.0 |
Sources
CVE-2018-20170 · published · modified · JSON