PYSEC-2014-70

2014-04-1514:55:00

Google

osv.dev

0.003 Low

EPSS

Percentile

71.3%

JSON

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an “interaction between eventlet and python-memcached.”

CPENameOperatorVersion
python-keystoneclienteq0.2.2
python-keystoneclienteq0.1.2
python-keystoneclienteq0.1.1
python-keystoneclienteq0.2.5
python-keystoneclienteq0.4.1
python-keystoneclienteq0.5.0
python-keystoneclienteq0.3.2
python-keystoneclienteq0.3.1
python-keystoneclienteq0.2.3
python-keystoneclienteq0.3.0

Name	Operator	Version
python-keystoneclient	eq	0.2.2
python-keystoneclient	eq	0.1.2
python-keystoneclient	eq	0.1.1
python-keystoneclient	eq	0.2.5
python-keystoneclient	eq	0.4.1
python-keystoneclient	eq	0.5.0
python-keystoneclient	eq	0.3.2
python-keystoneclient	eq	0.3.1
python-keystoneclient	eq	0.2.3
python-keystoneclient	eq	0.3.0