Authorization Bypass

2019-01-1508:55:16

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.003 Low

EPSS

Percentile

68.2%

JSON

python-keystoneclient is vulnerable to authorization bypass. An attacker with direct write access to the memcache backend is able to insert malicious data and bypass the encryption to tamper the encrypted data or modify data in memcached. Only setups that use memcache caching in the Keystone middleware and ENCRYPT or MAC as the memcache_security_strategy are affected.

CPENameOperatorVersion
python-keystoneclienteq0.2.3__2.el6ost
python-keystoneclienteq0.2.0__3.el6ost
python-keystoneclienteq0.1.3.27__1.el6
python-keystoneclienteq0.2.0__1.el6ost
python-keystoneclienteq0.2.0__4.el6ost
python-keystoneclienteq0.2.3__1.el6ost
python-keystoneclienteq0.2.3__2.el6ost
python-keystoneclienteq0.2.0__3.el6ost
python-keystoneclienteq0.1.3.27__1.el6
python-keystoneclienteq0.2.0__1.el6ost

Name	Operator	Version
python-keystoneclient	eq	0.2.3__2.el6ost
python-keystoneclient	eq	0.2.0__3.el6ost
python-keystoneclient	eq	0.1.3.27__1.el6
python-keystoneclient	eq	0.2.0__1.el6ost
python-keystoneclient	eq	0.2.0__4.el6ost
python-keystoneclient	eq	0.2.3__1.el6ost
python-keystoneclient	eq	0.2.3__2.el6ost
python-keystoneclient	eq	0.2.0__3.el6ost
python-keystoneclient	eq	0.1.3.27__1.el6
python-keystoneclient	eq	0.2.0__1.el6ost