Design/Logic Flaw

2014-04-1514:55:00

PRIOn knowledge base

www.prio-n.com

6.8 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

71.3%

JSON

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an “interaction between eventlet and python-memcached.”

CPENameOperatorVersion
python-keystoneclienteq0.3.1
python-keystoneclienteq0.2.2
python-keystoneclientle0.4.2
python-keystoneclienteq0.3.0
python-keystoneclienteq0.2.4
python-keystoneclienteq0.3.2
python-keystoneclienteq0.2.3

Name	Operator	Version
python-keystoneclient	eq	0.3.1
python-keystoneclient	eq	0.2.2
python-keystoneclient	le	0.4.2
python-keystoneclient	eq	0.3.0
python-keystoneclient	eq	0.2.4
python-keystoneclient	eq	0.3.2
python-keystoneclient	eq	0.2.3