108 matches found
SUSE CVE-2015-1852
The s3token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration paste.ini file regardless of the value, which allows remote attackers to conduct...
GHSA-4RRR-J7FF-R844 python-keystoneclient missing expiration check in PKI token validation
python-keystoneclient before 0.2.4, as used in OpenStack Keystone Folsom, does not properly check expiry for PKI tokens, which allows remote authenticated users to 1 retain use of a token after it has expired, or 2 use a revoked token once it expires...
python-keystoneclient missing expiration check in PKI token validation
python-keystoneclient before 0.2.4, as used in OpenStack Keystone Folsom, does not properly check expiry for PKI tokens, which allows remote authenticated users to 1 retain use of a token after it has expired, or 2 use a revoked token once it expires...
OpenStack keystonemiddleware and python-keystoneclient vulnerable to man-in-the-middle attacks
The s3token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration paste.ini file regardless of the value, which allows remote attackers to conduct...
GHSA-P9WQ-MJH8-Q72M OpenStack keystonemiddleware and python-keystoneclient vulnerable to man-in-the-middle attacks
The s3token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration paste.ini file regardless of the value, which allows remote attackers to conduct...
GHSA-8Q2M-PWXF-JC7G python-keystoneclient unsecure user password update
The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process...
python-keystoneclient unsecure user password update
The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process...
python-keystoneclient vulnerable to context confusion in Keystone auth_token middleware
A context confusion vulnerability was identified in Keystone authtoken middleware shipped in python-keystoneclient before 0.7.0. By doing repeated requests, with sufficient load on the target system, an authenticated user may in certain situations assume another authenticated user's complete...
GHSA-C3XQ-CJ8F-7829 Inadequate Encryption Strength in python-keystoneclient
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass...
Inadequate Encryption Strength in python-keystoneclient
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass...
Insufficient Verification of Data Authenticity in python-keystoneclient
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass...
GHSA-9VG3-CF92-H2H7 Insufficient Verification of Data Authenticity in python-keystoneclient
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass...
CVE-2013-2167
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass...
CVE-2013-2166
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass...
CVE-2013-2167
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass...
CVE-2013-2166
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass...
PYSEC-2019-197
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass...
PYSEC-2019-197
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass...
