CVE-2018-0041

Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 use hardcoded credentials to access Keystone service. These credentials allow network based attackers unauthorized access to information stored in keystone...

Hardcoded credentials

Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 use hardcoded credentials to access Keystone service. These credentials allow network based attackers unauthorized access to information stored in keystone...

CVE-2018-0041

The CVE-2018-0041 entry concerns Juniper Networks Contrail Service Orchestration (CSO) prior to version 3.3.0, where hard-coded credentials grant network-based attackers unauthorized access to Keystone service data. Root cause: hard-coded credentials in CSO access to Keystone. Affected product: C...

CVE-2018-0041 Contrail Service Orchestration: Hardcoded credentials for Keystone service.

Juniper Networks Contrail Service Orchestration releases prior to 3.3.0 use hardcoded credentials to access Keystone service. These credentials allow network based attackers unauthorized access to information stored in keystone...

Security Bulletin: Vulnerability in Keystone affects IBM SmartCloud Orchestrator (CVE-2014-3520)

Summary Vulnerability in Keystone affects IBM SmartCloud Orchestrator CVE-2014-3520. Vulnerability Details Keystone V2 trusts privilege escalation through user supplied project ID. By using an out-of-scope project ID, a trustee might gain unauthorized access if the trustor has the required roles ...

Security Bulletin: Vulnerability in Keystone affects IBM SmartCloud Orchestrator (CVE-2014-3476)

Summary Vulnerability in Keystone affects IBM SmartCloud Orchestrator CVE-2014-3476. Vulnerability Details By creating a delegation from a trust or OAuth token, a trustee might abuse the identity impersonation against keystone and circumvent the enforced scope, which results in potential elevated...

Security Bulletin: IBM SmartCloud Orchestrator - Keystone DoS through V3 API authentication chaining (CVE-2014-2828)

Summary By sending a single request with the same authentication method multiple times, a remote attacker might generate unwanted load on the Keystone host, which might potentially result in a Denial of Service against a Keystone service. Only Keystone setups enabling V3 API are affected...

Security Bulletin: IBM SmartCloud Orchestartor - Trustee token revocation does not work with memcache backend (CVE-2014-2237)

Summary When a trustor issues a trust token with impersonation enabled, the token is only added to the trustor's token list and not to the trustee's token list. This scenario results in the trust token not being invalidated by the trustee's token revocation bulk revocation. It is most noticeable...

keystone node module authentication bypass vulnerability

The keystone node module is a set of web application frameworks. A security vulnerability exists in keystone node module versions prior to 0.3.16. The vulnerability can be exploited to bypass authentication by providing the correct password and a partial e-mail address...

d-pac.cms (=0.5.7), keystone-db-shortcuts (>=0.0.9 <=0.1.15) +12 more potentially affected by CVE-2015-9240 via keystone (>=0.2.26 <=0.2.42)

keystone NPM version =0.2.26, =0.0.9, =0.0.1, =1.0.2, =0.0.0, =0.0.8, =0.0.8, =0.0.3, =0.0.4, =0.0.30 Source cves: CVE-2015-9240 Source advisory: OSV:GHSA-39PJ-GQ8Q-9PFJ...

Authentication Weakness in keystone

Versions of keystone prior to 0.3.16 are affected by a partial authentication bypass vulnerability. In the default sign in functionality, if an attacker provides a full and correct password, yet only provides part of the associated email address, authentication will be granted. Recommendation...

GHSA-39PJ-GQ8Q-9PFJ Authentication Weakness in keystone

Versions of keystone prior to 0.3.16 are affected by a partial authentication bypass vulnerability. In the default sign in functionality, if an attacker provides a full and correct password, yet only provides part of the associated email address, authentication will be granted. Recommendation...

Security update for ceph (important)

This update for ceph fixes the following issues: Security issues fixed: - CVE-2018-7262: rgw: malformed http headers can crash rgw bsc1081379. - CVE-2017-16818: User reachable asserts allow for DoS bsc1063014. Bug fixes: - bsc1061461: OSDs keep generating coredumps after adding new OSD node to...

Default credentials

Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in...

CVE-2015-9240

Due to a bug in the the default sign in functionality in the keystone node module before 0.3.16, incomplete email addresses could be matched. A correct password is still required to complete sign in...

CVE-2015-9240

CVE-2015-9240 affects the keystone node module prior to 0.3.16. The vulnerability is a partial authentication bypass in the default sign-in flow: if an attacker provides a full and correct password but only a partial email address, authentication can be granted. Affected component is the keystone...

CVE-2017-2592

python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component...

Information disclosure

python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component...

CVE-2017-2592

python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component...

DEBIAN-CVE-2017-2592

python-oslo-middleware before versions 3.8.1, 3.19.1, 3.23.1 is vulnerable to an information disclosure. Software using the CatchError class could include sensitive values in a traceback's error message. System users could exploit this flaw to obtain sensitive information from OpenStack component...