Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1jYzk5LXdobTUtbW1xM84AAufw

Openstack Keystone Incorrect Authorization vulnerability

A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A patch is available.

Permalink: https://github.com/advisories/GHSA-cc99-whm5-mmq3
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jYzk5LXdobTUtbW1xM84AAufw
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: about 2 years ago
Updated: 10 months ago

CVSS Score: 9.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Identifiers: GHSA-cc99-whm5-mmq3, CVE-2021-3563
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-3563
• https://access.redhat.com/security/cve/CVE-2021-3563
• https://bugs.launchpad.net/ossa/+bug/1901891
• https://bugzilla.redhat.com/show_bug.cgi?id=1962908
• https://security-tracker.debian.org/tracker/CVE-2021-3563
• https://review.opendev.org/c/openstack/keystone/+/803641
• https://review.opendev.org/c/openstack/keystone/+/828595
• https://review.opendev.org/c/openstack/keystone/+/856489
• https://lists.debian.org/debian-lts-announce/2024/01/msg00007.html
• https://opendev.org/openstack/keystone/commit/7859ed26003858ebfd9a5e866b43f1a6a9e83dca
• https://github.com/advisories/GHSA-cc99-whm5-mmq3

Blast Radius: 14.3

Affected Packages