CVE-2021-3563

CVE-2021-3563 affects OpenStack Keystone. The issue stems from keystone only validating the first 72 characters of an application secret, enabling bypass of some password complexity checks and affecting confidentiality and integrity. The vulnerability is listed across multiple advisories (e.g., D...

CVE-2021-38155

CVE-2021-38155 affects OpenStack Keystone 10.x–19.x; an unauthenticated actor can confirm account existence and retrieve the account UUID by guessing the account name and triggering repeated failed authentications, when security_compliance.lockout_failure_attempts is enabled. Connected advisories...

CVE-2012-4456

CVE-2012-4456 affects OpenStack Keystone: the OS-KSADM/services and tenant APIs in Keystone Essex before 2012.1.2 and Folsom before folsom-2 fail to validate X-Auth-Token, allowing remote attackers to read the roles for an arbitrary user or to get, create, or delete arbitrary services. This is do...

CVE-2014-2828

CVE-2014-2828 affects OpenStack Keystone (V3 API) where an attacker can trigger a denial of service by sending many requests using the same authentication method. The vulnerability exists in Keystone 2013.1 before 2013.2.4 and in Icehouse before icehouse-rc2. Public advisories from Red Hat, IBM, ...

CVE-2015-7546

CVE-2015-7546 affects OpenStack Keystone and related keystonemiddleware: the identity service fails to invalidate authorization tokens when using PKI or PKIZ providers, enabling remote authenticated users to bypass access controls by manipulating bytes in a revoked token. Affected versions includ...

CVE-2012-1572

OpenStack Keystone is affected by CVE-2012-1572: extremely long passwords can exhaust Keystone’s stack space and crash the service. The connected sources confirm this behavior but do not provide a specific remediation or patched version in the supplied documents.