Lucene search

K
ubuntucveUbuntu.comUB:CVE-2021-3563
HistoryAug 26, 2022 - 12:00 a.m.

CVE-2021-3563

2022-08-2600:00:00
ubuntu.com
ubuntu.com
9
openstack keystone
password complexity
data confidentiality

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

0.004 Low

EPSS

Percentile

75.1%

A flaw was found in openstack-keystone. Only the first 72 characters of an
application secret are verified allowing attackers bypass some password
complexity which administrators may be counting on. The highest threat from
this vulnerability is to data confidentiality and integrity.

Bugs

Notes

Author Note
mdeslaur no indication of possible fix from upstream as of 2023-01-03

7.4 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

0.004 Low

EPSS

Percentile

75.1%