Vulnerability Instance
Lookup for vulnerabilities affecting packages.
GET /api/vulnerabilities/217841?format=api
{ "url": "http://public2.vulnerablecode.io/api/vulnerabilities/217841?format=api", "vulnerability_id": "VCID-91cc-hzfb-3kek", "summary": "OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)", "aliases": [ { "alias": "PYSEC-2019-99" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/56087?format=api", "purl": "pkg:pypi/keystone@16.0.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3umd-756n-qqbx" }, { "vulnerability": "VCID-bbem-sea4-3ub4" }, { "vulnerability": "VCID-c18s-qdf4-3kdh" }, { "vulnerability": "VCID-esad-mak2-8bg2" }, { "vulnerability": "VCID-fhme-n8v8-ybev" }, { "vulnerability": "VCID-kzaw-9ex3-s3d5" }, { "vulnerability": "VCID-ngkx-25ft-8qhj" }, { "vulnerability": "VCID-nmb8-wq4u-2ug7" }, { "vulnerability": "VCID-saua-gpf5-2uhk" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@16.0.1" } ], "affected_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52840?format=api", "purl": "pkg:pypi/keystone@12.0.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3umd-756n-qqbx" }, { "vulnerability": "VCID-91cc-hzfb-3kek" }, { "vulnerability": "VCID-bbem-sea4-3ub4" }, { "vulnerability": "VCID-c18s-qdf4-3kdh" }, { "vulnerability": "VCID-fhme-n8v8-ybev" }, { "vulnerability": "VCID-jc9x-jf2k-t3h9" }, { "vulnerability": "VCID-kzaw-9ex3-s3d5" }, { "vulnerability": "VCID-nmb8-wq4u-2ug7" }, { "vulnerability": "VCID-nsx2-6bs2-7bcq" }, { "vulnerability": "VCID-p1m3-dt99-ruar" }, { "vulnerability": "VCID-saua-gpf5-2uhk" }, { "vulnerability": "VCID-x7zb-y9a8-tygv" }, { "vulnerability": "VCID-xfds-wmnb-qkcj" }, { "vulnerability": "VCID-xr4p-a78v-9bb6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@12.0.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/52841?format=api", "purl": "pkg:pypi/keystone@12.0.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3umd-756n-qqbx" }, { "vulnerability": "VCID-91cc-hzfb-3kek" }, { "vulnerability": "VCID-bbem-sea4-3ub4" }, { "vulnerability": "VCID-c18s-qdf4-3kdh" }, { "vulnerability": "VCID-fhme-n8v8-ybev" }, { "vulnerability": "VCID-jc9x-jf2k-t3h9" }, { "vulnerability": "VCID-kzaw-9ex3-s3d5" }, { "vulnerability": "VCID-nmb8-wq4u-2ug7" }, { "vulnerability": "VCID-nsx2-6bs2-7bcq" }, { "vulnerability": "VCID-p1m3-dt99-ruar" }, { "vulnerability": "VCID-saua-gpf5-2uhk" }, { "vulnerability": "VCID-x7zb-y9a8-tygv" }, { "vulnerability": "VCID-xfds-wmnb-qkcj" }, { "vulnerability": "VCID-xr4p-a78v-9bb6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@12.0.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/52842?format=api", "purl": "pkg:pypi/keystone@13.0.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3umd-756n-qqbx" }, { "vulnerability": "VCID-91cc-hzfb-3kek" }, { "vulnerability": "VCID-bbem-sea4-3ub4" }, { "vulnerability": "VCID-c18s-qdf4-3kdh" }, { "vulnerability": "VCID-fhme-n8v8-ybev" }, { "vulnerability": "VCID-jc9x-jf2k-t3h9" }, { "vulnerability": "VCID-kzaw-9ex3-s3d5" }, { "vulnerability": "VCID-ngkx-25ft-8qhj" }, { "vulnerability": "VCID-nmb8-wq4u-2ug7" }, { "vulnerability": "VCID-nsx2-6bs2-7bcq" }, { "vulnerability": "VCID-p1m3-dt99-ruar" }, { "vulnerability": "VCID-saua-gpf5-2uhk" }, { "vulnerability": "VCID-x7zb-y9a8-tygv" }, { "vulnerability": "VCID-xfds-wmnb-qkcj" }, { "vulnerability": "VCID-xr4p-a78v-9bb6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@13.0.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/52843?format=api", "purl": "pkg:pypi/keystone@13.0.3", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3umd-756n-qqbx" }, { "vulnerability": "VCID-91cc-hzfb-3kek" }, { "vulnerability": "VCID-bbem-sea4-3ub4" }, { "vulnerability": "VCID-c18s-qdf4-3kdh" }, { "vulnerability": "VCID-fhme-n8v8-ybev" }, { "vulnerability": "VCID-jc9x-jf2k-t3h9" }, { "vulnerability": "VCID-kzaw-9ex3-s3d5" }, { "vulnerability": "VCID-ngkx-25ft-8qhj" }, { "vulnerability": "VCID-nmb8-wq4u-2ug7" }, { "vulnerability": "VCID-nsx2-6bs2-7bcq" }, { "vulnerability": "VCID-p1m3-dt99-ruar" }, { "vulnerability": "VCID-saua-gpf5-2uhk" }, { "vulnerability": "VCID-x7zb-y9a8-tygv" }, { "vulnerability": "VCID-xfds-wmnb-qkcj" }, { "vulnerability": "VCID-xr4p-a78v-9bb6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@13.0.3" }, { "url": "http://public2.vulnerablecode.io/api/packages/52844?format=api", "purl": "pkg:pypi/keystone@13.0.4", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3umd-756n-qqbx" }, { "vulnerability": "VCID-91cc-hzfb-3kek" }, { "vulnerability": "VCID-bbem-sea4-3ub4" }, { "vulnerability": "VCID-c18s-qdf4-3kdh" }, { "vulnerability": "VCID-fhme-n8v8-ybev" }, { "vulnerability": "VCID-jc9x-jf2k-t3h9" }, { "vulnerability": "VCID-kzaw-9ex3-s3d5" }, { "vulnerability": "VCID-ngkx-25ft-8qhj" }, { "vulnerability": "VCID-nmb8-wq4u-2ug7" }, { "vulnerability": "VCID-nsx2-6bs2-7bcq" }, { "vulnerability": "VCID-p1m3-dt99-ruar" }, { "vulnerability": "VCID-saua-gpf5-2uhk" }, { "vulnerability": "VCID-x7zb-y9a8-tygv" }, { "vulnerability": "VCID-xfds-wmnb-qkcj" }, { "vulnerability": "VCID-xr4p-a78v-9bb6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@13.0.4" }, { "url": "http://public2.vulnerablecode.io/api/packages/52845?format=api", "purl": "pkg:pypi/keystone@14.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3umd-756n-qqbx" }, { "vulnerability": "VCID-91cc-hzfb-3kek" }, { "vulnerability": "VCID-bbem-sea4-3ub4" }, { "vulnerability": "VCID-c18s-qdf4-3kdh" }, { "vulnerability": "VCID-esad-mak2-8bg2" }, { "vulnerability": "VCID-fhme-n8v8-ybev" }, { "vulnerability": "VCID-jc9x-jf2k-t3h9" }, { "vulnerability": "VCID-kzaw-9ex3-s3d5" }, { "vulnerability": "VCID-ngkx-25ft-8qhj" }, { "vulnerability": "VCID-nmb8-wq4u-2ug7" }, { "vulnerability": "VCID-nsx2-6bs2-7bcq" }, { "vulnerability": "VCID-p1m3-dt99-ruar" }, { "vulnerability": "VCID-saua-gpf5-2uhk" }, { "vulnerability": "VCID-x7zb-y9a8-tygv" }, { "vulnerability": "VCID-xfds-wmnb-qkcj" }, { "vulnerability": "VCID-xr4p-a78v-9bb6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@14.0.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/52846?format=api", "purl": "pkg:pypi/keystone@14.0.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3umd-756n-qqbx" }, { "vulnerability": "VCID-91cc-hzfb-3kek" }, { "vulnerability": "VCID-bbem-sea4-3ub4" }, { "vulnerability": "VCID-c18s-qdf4-3kdh" }, { "vulnerability": "VCID-esad-mak2-8bg2" }, { "vulnerability": "VCID-fhme-n8v8-ybev" }, { "vulnerability": "VCID-jc9x-jf2k-t3h9" }, { "vulnerability": "VCID-kzaw-9ex3-s3d5" }, { "vulnerability": "VCID-ngkx-25ft-8qhj" }, { "vulnerability": "VCID-nmb8-wq4u-2ug7" }, { "vulnerability": "VCID-nsx2-6bs2-7bcq" }, { "vulnerability": "VCID-p1m3-dt99-ruar" }, { "vulnerability": "VCID-saua-gpf5-2uhk" }, { "vulnerability": "VCID-x7zb-y9a8-tygv" }, { "vulnerability": "VCID-xfds-wmnb-qkcj" }, { "vulnerability": "VCID-xr4p-a78v-9bb6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@14.0.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/52847?format=api", "purl": "pkg:pypi/keystone@14.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3umd-756n-qqbx" }, { "vulnerability": "VCID-91cc-hzfb-3kek" }, { "vulnerability": "VCID-bbem-sea4-3ub4" }, { "vulnerability": "VCID-c18s-qdf4-3kdh" }, { "vulnerability": "VCID-esad-mak2-8bg2" }, { "vulnerability": "VCID-fhme-n8v8-ybev" }, { "vulnerability": "VCID-jc9x-jf2k-t3h9" }, { "vulnerability": "VCID-kzaw-9ex3-s3d5" }, { "vulnerability": "VCID-ngkx-25ft-8qhj" }, { "vulnerability": "VCID-nmb8-wq4u-2ug7" }, { "vulnerability": "VCID-nsx2-6bs2-7bcq" }, { "vulnerability": "VCID-saua-gpf5-2uhk" }, { "vulnerability": "VCID-x7zb-y9a8-tygv" }, { "vulnerability": "VCID-xfds-wmnb-qkcj" }, { "vulnerability": "VCID-xr4p-a78v-9bb6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@14.1.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/56079?format=api", "purl": "pkg:pypi/keystone@14.2.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3umd-756n-qqbx" }, { "vulnerability": "VCID-91cc-hzfb-3kek" }, { "vulnerability": "VCID-bbem-sea4-3ub4" }, { "vulnerability": "VCID-c18s-qdf4-3kdh" }, { "vulnerability": "VCID-esad-mak2-8bg2" }, { "vulnerability": "VCID-fhme-n8v8-ybev" }, { "vulnerability": "VCID-jc9x-jf2k-t3h9" }, { "vulnerability": "VCID-kzaw-9ex3-s3d5" }, { "vulnerability": "VCID-ngkx-25ft-8qhj" }, { "vulnerability": "VCID-nmb8-wq4u-2ug7" }, { "vulnerability": "VCID-nsx2-6bs2-7bcq" }, { "vulnerability": "VCID-saua-gpf5-2uhk" }, { "vulnerability": "VCID-x7zb-y9a8-tygv" }, { "vulnerability": "VCID-xfds-wmnb-qkcj" }, { "vulnerability": "VCID-xr4p-a78v-9bb6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@14.2.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/56080?format=api", "purl": "pkg:pypi/keystone@15.0.0.0rc1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3umd-756n-qqbx" }, { "vulnerability": "VCID-91cc-hzfb-3kek" }, { "vulnerability": "VCID-bbem-sea4-3ub4" }, { "vulnerability": "VCID-c18s-qdf4-3kdh" }, { "vulnerability": "VCID-esad-mak2-8bg2" }, { "vulnerability": "VCID-fhme-n8v8-ybev" }, { "vulnerability": "VCID-jc9x-jf2k-t3h9" }, { "vulnerability": "VCID-kzaw-9ex3-s3d5" }, { "vulnerability": "VCID-ngkx-25ft-8qhj" }, { "vulnerability": "VCID-nmb8-wq4u-2ug7" }, { "vulnerability": "VCID-nsx2-6bs2-7bcq" }, { "vulnerability": "VCID-saua-gpf5-2uhk" }, { "vulnerability": "VCID-x7zb-y9a8-tygv" }, { "vulnerability": "VCID-xfds-wmnb-qkcj" }, { "vulnerability": "VCID-xr4p-a78v-9bb6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@15.0.0.0rc1" }, { "url": "http://public2.vulnerablecode.io/api/packages/56081?format=api", "purl": "pkg:pypi/keystone@15.0.0.0rc2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3umd-756n-qqbx" }, { "vulnerability": "VCID-91cc-hzfb-3kek" }, { "vulnerability": "VCID-bbem-sea4-3ub4" }, { "vulnerability": "VCID-c18s-qdf4-3kdh" }, { "vulnerability": "VCID-esad-mak2-8bg2" }, { "vulnerability": "VCID-fhme-n8v8-ybev" }, { "vulnerability": "VCID-jc9x-jf2k-t3h9" }, { "vulnerability": "VCID-kzaw-9ex3-s3d5" }, { "vulnerability": "VCID-ngkx-25ft-8qhj" }, { "vulnerability": "VCID-nmb8-wq4u-2ug7" }, { "vulnerability": "VCID-nsx2-6bs2-7bcq" }, { "vulnerability": "VCID-saua-gpf5-2uhk" }, { "vulnerability": "VCID-x7zb-y9a8-tygv" }, { "vulnerability": "VCID-xfds-wmnb-qkcj" }, { "vulnerability": "VCID-xr4p-a78v-9bb6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@15.0.0.0rc2" }, { "url": "http://public2.vulnerablecode.io/api/packages/56082?format=api", "purl": "pkg:pypi/keystone@15.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3umd-756n-qqbx" }, { "vulnerability": "VCID-91cc-hzfb-3kek" }, { "vulnerability": "VCID-bbem-sea4-3ub4" }, { "vulnerability": "VCID-c18s-qdf4-3kdh" }, { "vulnerability": "VCID-esad-mak2-8bg2" }, { "vulnerability": "VCID-fhme-n8v8-ybev" }, { "vulnerability": "VCID-jc9x-jf2k-t3h9" }, { "vulnerability": "VCID-kzaw-9ex3-s3d5" }, { "vulnerability": "VCID-ngkx-25ft-8qhj" }, { "vulnerability": "VCID-nmb8-wq4u-2ug7" }, { "vulnerability": "VCID-nsx2-6bs2-7bcq" }, { "vulnerability": "VCID-saua-gpf5-2uhk" }, { "vulnerability": "VCID-x7zb-y9a8-tygv" }, { "vulnerability": "VCID-xfds-wmnb-qkcj" }, { "vulnerability": "VCID-xr4p-a78v-9bb6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@15.0.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/56083?format=api", "purl": "pkg:pypi/keystone@15.0.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3umd-756n-qqbx" }, { "vulnerability": "VCID-91cc-hzfb-3kek" }, { "vulnerability": "VCID-bbem-sea4-3ub4" }, { "vulnerability": "VCID-c18s-qdf4-3kdh" }, { "vulnerability": "VCID-esad-mak2-8bg2" }, { "vulnerability": "VCID-fhme-n8v8-ybev" }, { "vulnerability": "VCID-kzaw-9ex3-s3d5" }, { "vulnerability": "VCID-ngkx-25ft-8qhj" }, { "vulnerability": "VCID-nmb8-wq4u-2ug7" }, { "vulnerability": "VCID-saua-gpf5-2uhk" }, { "vulnerability": "VCID-x7zb-y9a8-tygv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@15.0.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/56084?format=api", "purl": "pkg:pypi/keystone@16.0.0.0rc1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3umd-756n-qqbx" }, { "vulnerability": "VCID-91cc-hzfb-3kek" }, { "vulnerability": "VCID-bbem-sea4-3ub4" }, { "vulnerability": "VCID-c18s-qdf4-3kdh" }, { "vulnerability": "VCID-esad-mak2-8bg2" }, { "vulnerability": "VCID-fhme-n8v8-ybev" }, { "vulnerability": "VCID-kzaw-9ex3-s3d5" }, { "vulnerability": "VCID-ngkx-25ft-8qhj" }, { "vulnerability": "VCID-nmb8-wq4u-2ug7" }, { "vulnerability": "VCID-saua-gpf5-2uhk" }, { "vulnerability": "VCID-x7zb-y9a8-tygv" }, { "vulnerability": "VCID-xfds-wmnb-qkcj" }, { "vulnerability": "VCID-xr4p-a78v-9bb6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@16.0.0.0rc1" }, { "url": "http://public2.vulnerablecode.io/api/packages/56085?format=api", "purl": "pkg:pypi/keystone@16.0.0.0rc2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3umd-756n-qqbx" }, { "vulnerability": "VCID-91cc-hzfb-3kek" }, { "vulnerability": "VCID-bbem-sea4-3ub4" }, { "vulnerability": "VCID-c18s-qdf4-3kdh" }, { "vulnerability": "VCID-esad-mak2-8bg2" }, { "vulnerability": "VCID-fhme-n8v8-ybev" }, { "vulnerability": "VCID-kzaw-9ex3-s3d5" }, { "vulnerability": "VCID-ngkx-25ft-8qhj" }, { "vulnerability": "VCID-nmb8-wq4u-2ug7" }, { "vulnerability": "VCID-saua-gpf5-2uhk" }, { "vulnerability": "VCID-x7zb-y9a8-tygv" }, { "vulnerability": "VCID-xfds-wmnb-qkcj" }, { "vulnerability": "VCID-xr4p-a78v-9bb6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@16.0.0.0rc2" }, { "url": "http://public2.vulnerablecode.io/api/packages/56086?format=api", "purl": "pkg:pypi/keystone@16.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-3umd-756n-qqbx" }, { "vulnerability": "VCID-91cc-hzfb-3kek" }, { "vulnerability": "VCID-bbem-sea4-3ub4" }, { "vulnerability": "VCID-c18s-qdf4-3kdh" }, { "vulnerability": "VCID-esad-mak2-8bg2" }, { "vulnerability": "VCID-fhme-n8v8-ybev" }, { "vulnerability": "VCID-jc9x-jf2k-t3h9" }, { "vulnerability": "VCID-kzaw-9ex3-s3d5" }, { "vulnerability": "VCID-ngkx-25ft-8qhj" }, { "vulnerability": "VCID-nmb8-wq4u-2ug7" }, { "vulnerability": "VCID-nsx2-6bs2-7bcq" }, { "vulnerability": "VCID-saua-gpf5-2uhk" }, { "vulnerability": "VCID-x7zb-y9a8-tygv" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@16.0.0" } ], "references": [ { "reference_url": "https://access.redhat.com/errata/RHSA-2019:4358", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2019:4358" }, { "reference_url": "https://bugs.launchpad.net/keystone/+bug/1855080", "reference_id": "", "reference_type": "", "scores": [], "url": "https://bugs.launchpad.net/keystone/+bug/1855080" }, { "reference_url": "https://review.opendev.org/#/c/697355/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://review.opendev.org/#/c/697355/" }, { "reference_url": "https://review.opendev.org/#/c/697611/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://review.opendev.org/#/c/697611/" }, { "reference_url": "https://review.opendev.org/#/c/697731/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://review.opendev.org/#/c/697731/" }, { "reference_url": "https://security.openstack.org/ossa/OSSA-2019-006.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.openstack.org/ossa/OSSA-2019-006.html" }, { "reference_url": "https://usn.ubuntu.com/4262-1/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4262-1/" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2019/12/11/8", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.openwall.com/lists/oss-security/2019/12/11/8" } ], "weaknesses": [], "exploits": [], "severity_range_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "risk_score": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-91cc-hzfb-3kek" }