Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/keystone@16.0.0
Typepypi
Namespace
Namekeystone
Version16.0.0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version16.0.1
Latest_non_vulnerable_version2014.2.4
Affected_by_vulnerabilities
0
url VCID-91yw-81v7-jbay
vulnerability_id VCID-91yw-81v7-jbay
summary OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)
references
0
reference_url https://access.redhat.com/errata/RHSA-2019:4358
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2019:4358
1
reference_url https://bugs.launchpad.net/keystone/+bug/1855080
reference_id
reference_type
scores
url https://bugs.launchpad.net/keystone/+bug/1855080
2
reference_url https://review.opendev.org/#/c/697355/
reference_id
reference_type
scores
url https://review.opendev.org/#/c/697355/
3
reference_url https://review.opendev.org/#/c/697611/
reference_id
reference_type
scores
url https://review.opendev.org/#/c/697611/
4
reference_url https://review.opendev.org/#/c/697731/
reference_id
reference_type
scores
url https://review.opendev.org/#/c/697731/
5
reference_url https://security.openstack.org/ossa/OSSA-2019-006.html
reference_id
reference_type
scores
url https://security.openstack.org/ossa/OSSA-2019-006.html
6
reference_url https://usn.ubuntu.com/4262-1/
reference_id
reference_type
scores
url https://usn.ubuntu.com/4262-1/
7
reference_url http://www.openwall.com/lists/oss-security/2019/12/11/8
reference_id
reference_type
scores
url http://www.openwall.com/lists/oss-security/2019/12/11/8
fixed_packages
0
url pkg:pypi/keystone@16.0.1
purl pkg:pypi/keystone@16.0.1
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@16.0.1
aliases CVE-2019-19687, PYSEC-2019-29
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-91yw-81v7-jbay
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/keystone@16.0.0