OpenStack Keystone 2013.2

CPE Details

OpenStack Keystone 2013.2
openstack
keystone
2013.2
2013-12-16
19h46 +00:00
2014-04-18
11h36 +00:00
CPE NVD
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:openstack:keystone:2013.2:*:*:*:*:*:*:*

Informations

Vendor

openstack

Product

keystone

Version

2013.2

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2021-3563 2022-08-26 15h25 +00:00 A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.
7.4
High
CVE-2014-3520 2014-10-26 19h00 +00:00 OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the project ID in a V2 API trust token request.
6.5
CVE-2014-3621 2014-10-02 12h00 +00:00 The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl endpoint field.
4
CVE-2014-3476 2014-06-17 12h00 +00:00 OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonation enabled to create a new token with additional roles.
6
CVE-2014-2828 2014-04-15 12h00 +00:00 The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication method in a request, aka "authentication chaining."
7.8
CVE-2013-6391 2013-12-14 16h00 +00:00 The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
5.8
CVE-2013-2157 2013-08-20 22h00 +00:00 OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
4.3