Lucene search

RedhatCVE-2021-3563

HistoryAug 26, 2022 - 4:15 p.m.

CVE-2021-3563

2022-08-2616:15:08

CWE-863

redhat

web.nvd.nist.gov

cve-2021-3563

openstack

keystone

data confidentiality

data integrity

password complexity

CVSS3

7.4

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

AI Score

7.2

Confidence

High

EPSS

0.009

Percentile

82.9%

JSON

A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.

Affected configurations

Nvd

Node

openstackkeystone

Node

debiandebian_linuxMatch10.0

debiandebian_linuxMatch11.0

Node

redhatopenstack_platformMatch10.0

redhatopenstack_platformMatch13.0

redhatopenstack_platformMatch16.1

redhatopenstack_platformMatch16.2

VendorProductVersionCPE
openstackkeystone*cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*
debiandebian_linux10.0cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
debiandebian_linux11.0cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
redhatopenstack_platform10.0cpe:2.3:a:redhat:openstack_platform:10.0:*:*:*:*:*:*:*
redhatopenstack_platform13.0cpe:2.3:a:redhat:openstack_platform:13.0:*:*:*:*:*:*:*
redhatopenstack_platform16.1cpe:2.3:a:redhat:openstack_platform:16.1:*:*:*:*:*:*:*
redhatopenstack_platform16.2cpe:2.3:a:redhat:openstack_platform:16.2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
openstack	keystone	*	cpe:2.3:a:openstack:keystone::::::::
debian	debian_linux	10.0	cpe:2.3:o:debian:debian_linux:10.0:::::::*
debian	debian_linux	11.0	cpe:2.3:o:debian:debian_linux:11.0:::::::*
redhat	openstack_platform	10.0	cpe:2.3:a:redhat:openstack_platform:10.0:::::::*
redhat	openstack_platform	13.0	cpe:2.3:a:redhat:openstack_platform:13.0:::::::*
redhat	openstack_platform	16.1	cpe:2.3:a:redhat:openstack_platform:16.1:::::::*
redhat	openstack_platform	16.2	cpe:2.3:a:redhat:openstack_platform:16.2:::::::*

CNA Affected

[
  {
    "product": "keystone",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Not-known"
      }
    ]
  }
]