Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/9731?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/9731?format=api", "purl": "pkg:pypi/keystone@16.0.0.0rc2", "type": "pypi", "namespace": "", "name": "keystone", "version": "16.0.0.0rc2", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "26.1.1", "latest_non_vulnerable_version": "28.0.1", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/5292?format=api", "vulnerability_id": "VCID-2ggr-pe4y-y3cn", "summary": "OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary user to an arbitrary tenant via a request to update the user's default tenant to the administrative API. NOTE: this identifier was originally incorrectly assigned to an open redirect issue, but the correct identifier for that issue is CVE-2012-3540.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-3542.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-3542.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2012-3542", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.01949", "scoring_system": "epss", "scoring_elements": "0.83393", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.01949", "scoring_system": "epss", "scoring_elements": "0.83527", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.01949", "scoring_system": "epss", "scoring_elements": "0.83524", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.01949", "scoring_system": "epss", "scoring_elements": "0.83518", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.01949", "scoring_system": "epss", "scoring_elements": "0.83495", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.01949", "scoring_system": "epss", "scoring_elements": "0.83494", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.01949", "scoring_system": "epss", "scoring_elements": "0.83492", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.01949", "scoring_system": "epss", "scoring_elements": "0.83457", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.01949", "scoring_system": "epss", "scoring_elements": "0.83461", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.01949", "scoring_system": "epss", "scoring_elements": "0.83467", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.01949", "scoring_system": "epss", "scoring_elements": "0.83453", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.01949", "scoring_system": "epss", "scoring_elements": "0.83443", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.01949", "scoring_system": "epss", "scoring_elements": "0.83419", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.01949", "scoring_system": "epss", "scoring_elements": "0.8342", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.01949", "scoring_system": "epss", "scoring_elements": "0.83406", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2012-3542" }, { "reference_url": "https://bugs.launchpad.net/keystone/+bug/1040626", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugs.launchpad.net/keystone/+bug/1040626" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3542", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3542" }, { "reference_url": "http://secunia.com/advisories/50467", "reference_id": "", "reference_type": "", "scores": [], "url": "http://secunia.com/advisories/50467" }, { "reference_url": "http://secunia.com/advisories/50494", "reference_id": "", "reference_type": "", "scores": [], "url": "http://secunia.com/advisories/50494" }, { "reference_url": "https://github.com/openstack/keystone", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/openstack/keystone" }, { "reference_url": "https://github.com/openstack/keystone/commit/5438d3b5a219d7c8fa67e66e538d325a61617155", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/openstack/keystone/commit/5438d3b5a219d7c8fa67e66e538d325a61617155" }, { "reference_url": "https://github.com/openstack/keystone/commit/c13d0ba606f7b2bdc609a7f388334e5efec3f3aa", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/openstack/keystone/commit/c13d0ba606f7b2bdc609a7f388334e5efec3f3aa" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2012-19.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2012-19.yaml" }, { "reference_url": "https://lists.launchpad.net/openstack/msg16282.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.launchpad.net/openstack/msg16282.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3542", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.3", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:M/Au:N/C:N/I:P/A:N" }, { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3542" }, { "reference_url": "https://web.archive.org/web/20121114023909/http://www.securityfocus.com/bid/55326", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20121114023909/http://www.securityfocus.com/bid/55326" }, { "reference_url": "https://web.archive.org/web/20140802052724/http://secunia.com/advisories/50467", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20140802052724/http://secunia.com/advisories/50467" }, { "reference_url": "https://web.archive.org/web/20140804204333/http://secunia.com/advisories/50494", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20140804204333/http://secunia.com/advisories/50494" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2012/08/30/6", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2012/08/30/6" }, { "reference_url": "http://www.securityfocus.com/bid/55326", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.securityfocus.com/bid/55326" }, { "reference_url": "http://www.ubuntu.com/usn/USN-1552-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.ubuntu.com/usn/USN-1552-1" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=852510", "reference_id": "852510", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=852510" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:openstack:essex:2012.1:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:openstack:essex:2012.1:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:openstack:essex:2012.1:*:*:*:*:*:*:*" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:openstack:horizon:folsom-3:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:openstack:horizon:folsom-3:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:openstack:horizon:folsom-3:*:*:*:*:*:*:*" }, { "reference_url": "https://github.com/advisories/GHSA-gf2q-j2qq-pjf2", "reference_id": "GHSA-gf2q-j2qq-pjf2", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-gf2q-j2qq-pjf2" }, { "reference_url": "https://usn.ubuntu.com/1552-1/", "reference_id": "USN-1552-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/1552-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/54756?format=api", "purl": "pkg:pypi/keystone@2012.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-s84r-551v-u7b6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@2012.1" } ], "aliases": [ "CVE-2012-3542", "GHSA-gf2q-j2qq-pjf2", "PYSEC-2012-19" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-2ggr-pe4y-y3cn" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/90501?format=api", "vulnerability_id": "VCID-769v-tw47-rucm", "summary": "OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)", "references": [ { "reference_url": "https://access.redhat.com/errata/RHSA-2019:4358", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2019:4358" }, { "reference_url": "https://bugs.launchpad.net/keystone/+bug/1855080", "reference_id": "", "reference_type": "", "scores": [], "url": "https://bugs.launchpad.net/keystone/+bug/1855080" }, { "reference_url": "https://review.opendev.org/#/c/697355/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://review.opendev.org/#/c/697355/" }, { "reference_url": "https://review.opendev.org/#/c/697611/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://review.opendev.org/#/c/697611/" }, { "reference_url": "https://review.opendev.org/#/c/697731/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://review.opendev.org/#/c/697731/" }, { "reference_url": "https://security.openstack.org/ossa/OSSA-2019-006.html", "reference_id": "", "reference_type": "", "scores": [], "url": "https://security.openstack.org/ossa/OSSA-2019-006.html" }, { "reference_url": "https://usn.ubuntu.com/4262-1/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4262-1/" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2019/12/11/8", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.openwall.com/lists/oss-security/2019/12/11/8" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/9733?format=api", "purl": "pkg:pypi/keystone@16.0.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ggr-pe4y-y3cn" }, { "vulnerability": "VCID-89vf-n61h-k3b2" }, { "vulnerability": "VCID-93vc-hgec-nfe6" }, { "vulnerability": "VCID-9dhg-r711-yfg6" }, { "vulnerability": "VCID-p5un-b12x-tuh5" }, { "vulnerability": "VCID-r25g-be38-b3be" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@16.0.1" } ], "aliases": [ "PYSEC-2019-99" ], "risk_score": null, "exploitability": "0.5", "weighted_severity": "0.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-769v-tw47-rucm" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/55185?format=api", "vulnerability_id": "VCID-89vf-n61h-k3b2", "summary": "OpenStack Keystone does not invalidate existing tokens when granting or revoking roles\nOpenStack Keystone before 2012.1.3 does not invalidate existing tokens when granting or revoking roles, which allows remote authenticated users to retain the privileges of the revoked roles.", "references": [ { "reference_url": "http://github.com/openstack/keystone/commit/58ac6691a21675be9e2ffb0f84a05fc3cd4d2e2e", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://github.com/openstack/keystone/commit/58ac6691a21675be9e2ffb0f84a05fc3cd4d2e2e" }, { "reference_url": "http://osvdb.org/85484", "reference_id": "", "reference_type": "", "scores": [], "url": "http://osvdb.org/85484" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2012:1378", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://access.redhat.com/errata/RHSA-2012:1378" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-4413.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2012-4413.json" }, { "reference_url": "https://access.redhat.com/security/cve/CVE-2012-4413", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://access.redhat.com/security/cve/CVE-2012-4413" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2012-4413", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00428", "scoring_system": "epss", "scoring_elements": "0.6251", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00428", "scoring_system": "epss", "scoring_elements": "0.62435", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00428", "scoring_system": "epss", "scoring_elements": "0.62402", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00428", "scoring_system": "epss", "scoring_elements": "0.6245", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00428", "scoring_system": "epss", "scoring_elements": "0.62467", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00428", "scoring_system": "epss", "scoring_elements": "0.62486", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00428", "scoring_system": "epss", "scoring_elements": "0.62475", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00428", "scoring_system": "epss", "scoring_elements": "0.62453", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00428", "scoring_system": "epss", "scoring_elements": "0.62497", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00428", "scoring_system": "epss", "scoring_elements": "0.62503", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00428", "scoring_system": "epss", "scoring_elements": "0.62496", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00428", "scoring_system": "epss", "scoring_elements": "0.62513", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00428", "scoring_system": "epss", "scoring_elements": "0.62346", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00428", "scoring_system": "epss", "scoring_elements": "0.62404", "published_at": "2026-04-02T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2012-4413" }, { "reference_url": "https://bugs.launchpad.net/keystone/+bug/1041396", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugs.launchpad.net/keystone/+bug/1041396" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=855491", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=855491" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4413", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4413" }, { "reference_url": "http://secunia.com/advisories/50531", "reference_id": "", "reference_type": "", "scores": [], "url": "http://secunia.com/advisories/50531" }, { "reference_url": "http://secunia.com/advisories/50590", "reference_id": "", "reference_type": "", "scores": [], "url": "http://secunia.com/advisories/50590" }, { "reference_url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78478", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78478" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4413", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.0", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:L/Au:S/C:N/I:P/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-4413" }, { "reference_url": "https://opendev.org/openstack/keystone", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://opendev.org/openstack/keystone" }, { "reference_url": "https://review.opendev.org/c/openstack/keystone/+/12870", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://review.opendev.org/c/openstack/keystone/+/12870" }, { "reference_url": "https://review.opendev.org/c/openstack/keystone/+/12870/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://review.opendev.org/c/openstack/keystone/+/12870/" }, { "reference_url": "https://web.archive.org/web/20121114023848/http://www.securityfocus.com/bid/55524", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20121114023848/http://www.securityfocus.com/bid/55524" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2012/09/12/7", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2012/09/12/7" }, { "reference_url": "http://www.securityfocus.com/bid/55524", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.securityfocus.com/bid/55524" }, { "reference_url": "http://www.ubuntu.com/usn/USN-1564-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.ubuntu.com/usn/USN-1564-1" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=687428", "reference_id": "687428", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=687428" }, { "reference_url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:openstack:keystone:2012.1.3:*:*:*:*:*:*:*", "reference_id": "cpe:2.3:a:openstack:keystone:2012.1.3:*:*:*:*:*:*:*", "reference_type": "", "scores": [], "url": "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:openstack:keystone:2012.1.3:*:*:*:*:*:*:*" }, { "reference_url": "https://github.com/advisories/GHSA-mrxv-65rv-6hxq", "reference_id": "GHSA-mrxv-65rv-6hxq", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-mrxv-65rv-6hxq" }, { "reference_url": "https://usn.ubuntu.com/1564-1/", "reference_id": "USN-1564-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/1564-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/82356?format=api", "purl": "pkg:pypi/keystone@2012.1.3", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@2012.1.3" } ], "aliases": [ "CVE-2012-4413", "GHSA-mrxv-65rv-6hxq" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-89vf-n61h-k3b2" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/53288?format=api", "vulnerability_id": "VCID-93vc-hgec-nfe6", "summary": "Openstack Keystone Incorrect Authorization vulnerability\nA flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A [patch](https://opendev.org/openstack/keystone/commit/7859ed26003858ebfd9a5e866b43f1a6a9e83dca) is available.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3563.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-3563.json" }, { "reference_url": "https://access.redhat.com/security/cve/CVE-2021-3563", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://access.redhat.com/security/cve/CVE-2021-3563" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3563", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17812", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17448", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17638", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17689", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17735", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17717", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17656", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17566", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17866", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.1765", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17516", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17539", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17628", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17593", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00056", "scoring_system": "epss", "scoring_elements": "0.17584", "published_at": "2026-04-16T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-3563" }, { "reference_url": "https://bugs.launchpad.net/ossa/+bug/1901891", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugs.launchpad.net/ossa/+bug/1901891" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1962908", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1962908" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3563", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3563" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00007.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00007.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3563", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3563" }, { "reference_url": "https://opendev.org/openstack/keystone", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://opendev.org/openstack/keystone" }, { "reference_url": "https://opendev.org/openstack/keystone/commit/7859ed26003858ebfd9a5e866b43f1a6a9e83dca", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://opendev.org/openstack/keystone/commit/7859ed26003858ebfd9a5e866b43f1a6a9e83dca" }, { "reference_url": "https://review.opendev.org/c/openstack/keystone/+/803641", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://review.opendev.org/c/openstack/keystone/+/803641" }, { "reference_url": "https://review.opendev.org/c/openstack/keystone/+/828595", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://review.opendev.org/c/openstack/keystone/+/828595" }, { "reference_url": "https://review.opendev.org/c/openstack/keystone/+/856489", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://review.opendev.org/c/openstack/keystone/+/856489" }, { "reference_url": "https://security-tracker.debian.org/tracker/CVE-2021-3563", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security-tracker.debian.org/tracker/CVE-2021-3563" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989998", "reference_id": "989998", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=989998" }, { "reference_url": "https://security.archlinux.org/AVG-1979", "reference_id": "AVG-1979", "reference_type": "", "scores": [ { "value": "Medium", "scoring_system": "archlinux", "scoring_elements": "" } ], "url": "https://security.archlinux.org/AVG-1979" }, { "reference_url": "https://github.com/advisories/GHSA-cc99-whm5-mmq3", "reference_id": "GHSA-cc99-whm5-mmq3", "reference_type": "", "scores": [ { "value": "CRITICAL", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-cc99-whm5-mmq3" }, { "reference_url": "https://usn.ubuntu.com/7926-1/", "reference_id": "USN-7926-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7926-1/" } ], "fixed_packages": [], "aliases": [ "CVE-2021-3563", "GHSA-cc99-whm5-mmq3" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-93vc-hgec-nfe6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/14506?format=api", "vulnerability_id": "VCID-9dhg-r711-yfg6", "summary": "Exposure of Sensitive Information to an Unauthorized Actor\nOpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument configuration option content, which allows remote authenticated users to obtain passwords and other sensitive backend information by reading the Keystone logs.", "references": [ { "reference_url": "http://lists.openstack.org/pipermail/openstack-announce/2015-May/000356.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://lists.openstack.org/pipermail/openstack-announce/2015-May/000356.html" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-3646.json", "reference_id": "", "reference_type": "", "scores": [], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-3646.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2015-3646", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00177", "scoring_system": "epss", "scoring_elements": "0.38811", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00177", "scoring_system": "epss", "scoring_elements": "0.39238", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00177", "scoring_system": "epss", "scoring_elements": "0.39201", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00177", "scoring_system": "epss", "scoring_elements": "0.39182", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00177", "scoring_system": "epss", "scoring_elements": "0.39207", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00177", "scoring_system": "epss", "scoring_elements": "0.39118", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00177", "scoring_system": "epss", "scoring_elements": "0.38909", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00177", "scoring_system": "epss", "scoring_elements": "0.38891", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00177", "scoring_system": "epss", "scoring_elements": "0.39029", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00177", "scoring_system": "epss", "scoring_elements": "0.39214", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00177", "scoring_system": "epss", "scoring_elements": "0.39236", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00177", "scoring_system": "epss", "scoring_elements": "0.39156", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00177", "scoring_system": "epss", "scoring_elements": "0.3921", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00177", "scoring_system": "epss", "scoring_elements": "0.39226", "published_at": "2026-04-09T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2015-3646" }, { "reference_url": "https://bugs.launchpad.net/keystone/+bug/1443598", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugs.launchpad.net/keystone/+bug/1443598" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3646", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3646" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "3.5", "scoring_system": "cvssv2", "scoring_elements": "AV:N/AC:M/Au:S/C:P/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/openstack/keystone", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/openstack/keystone" }, { "reference_url": "https://web.archive.org/web/20210122154200/http://www.securityfocus.com/bid/74456", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20210122154200/http://www.securityfocus.com/bid/74456" }, { "reference_url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.oracle.com/technetwork/topics/security/bulletinapr2015-2511959.html" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1218640", "reference_id": "1218640", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1218640" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3646", "reference_id": "CVE-2015-3646", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3646" }, { "reference_url": "https://github.com/advisories/GHSA-jwpw-ppj5-7h4w", "reference_id": "GHSA-jwpw-ppj5-7h4w", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-jwpw-ppj5-7h4w" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/50900?format=api", "purl": "pkg:pypi/keystone@2014.1.5", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@2014.1.5" }, { "url": "http://public2.vulnerablecode.io/api/packages/50901?format=api", "purl": "pkg:pypi/keystone@2014.2.4", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@2014.2.4" } ], "aliases": [ "CVE-2015-3646", "GHSA-jwpw-ppj5-7h4w" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-9dhg-r711-yfg6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/5978?format=api", "vulnerability_id": "VCID-gdk6-a746-6fac", "summary": "OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.)", "references": [ { "reference_url": "https://access.redhat.com/errata/RHSA-2019:4358", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://access.redhat.com/errata/RHSA-2019:4358" }, { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-19687.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.1", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-19687.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2019-19687", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00728", "scoring_system": "epss", "scoring_elements": "0.72565", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00728", "scoring_system": "epss", "scoring_elements": "0.72702", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00728", "scoring_system": "epss", "scoring_elements": "0.72706", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00728", "scoring_system": "epss", "scoring_elements": "0.72697", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00728", "scoring_system": "epss", "scoring_elements": "0.72566", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00728", "scoring_system": "epss", "scoring_elements": "0.72589", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00728", "scoring_system": "epss", "scoring_elements": "0.72573", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00728", "scoring_system": "epss", "scoring_elements": "0.72655", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00728", "scoring_system": "epss", "scoring_elements": "0.72664", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00728", "scoring_system": "epss", "scoring_elements": "0.72654", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00728", "scoring_system": "epss", "scoring_elements": "0.72612", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00728", "scoring_system": "epss", "scoring_elements": "0.72622", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00728", "scoring_system": "epss", "scoring_elements": "0.72639", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00728", "scoring_system": "epss", "scoring_elements": "0.72616", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00728", "scoring_system": "epss", "scoring_elements": "0.72604", "published_at": "2026-04-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-19687" }, { "reference_url": "https://bugs.launchpad.net/keystone/+bug/1855080", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugs.launchpad.net/keystone/+bug/1855080" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1781470", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1781470" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19687", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19687" }, { "reference_url": "https://github.com/openstack/keystone", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/openstack/keystone" }, { "reference_url": "https://github.com/openstack/keystone/commit/17947516b0095c51da5cff94771247f2e7c44ee6", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/openstack/keystone/commit/17947516b0095c51da5cff94771247f2e7c44ee6" }, { "reference_url": "https://github.com/openstack/keystone/commit/17c337dbdbfb9d548ad531c2ad0483c9bce5b98f", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/openstack/keystone/commit/17c337dbdbfb9d548ad531c2ad0483c9bce5b98f" }, { "reference_url": "https://github.com/openstack/keystone/commit/bd3f63787151183f4daa43578aa491856fefae5b", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/openstack/keystone/commit/bd3f63787151183f4daa43578aa491856fefae5b" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2019-29.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2019-29.yaml" }, { "reference_url": "https://git.openstack.org/cgit/openstack/keystone/commit/?id=17947516b0095c51da5cff94771247f2e7c44ee6", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://git.openstack.org/cgit/openstack/keystone/commit/?id=17947516b0095c51da5cff94771247f2e7c44ee6" }, { "reference_url": "https://git.openstack.org/cgit/openstack/keystone/commit/?id=17c337dbdbfb9d548ad531c2ad0483c9bce5b98f", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://git.openstack.org/cgit/openstack/keystone/commit/?id=17c337dbdbfb9d548ad531c2ad0483c9bce5b98f" }, { "reference_url": "https://git.openstack.org/cgit/openstack/keystone/commit/?id=bd3f63787151183f4daa43578aa491856fefae5b", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://git.openstack.org/cgit/openstack/keystone/commit/?id=bd3f63787151183f4daa43578aa491856fefae5b" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19687", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19687" }, { "reference_url": "https://review.opendev.org/#/c/697355", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://review.opendev.org/#/c/697355" }, { "reference_url": "https://review.opendev.org/#/c/697355/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://review.opendev.org/#/c/697355/" }, { "reference_url": "https://review.opendev.org/#/c/697611", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://review.opendev.org/#/c/697611" }, { "reference_url": "https://review.opendev.org/#/c/697611/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://review.opendev.org/#/c/697611/" }, { "reference_url": "https://review.opendev.org/#/c/697731", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://review.opendev.org/#/c/697731" }, { "reference_url": "https://review.opendev.org/#/c/697731/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://review.opendev.org/#/c/697731/" }, { "reference_url": "https://security.openstack.org/ossa/OSSA-2019-006.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.openstack.org/ossa/OSSA-2019-006.html" }, { "reference_url": "https://usn.ubuntu.com/4262-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/4262-1" }, { "reference_url": "https://usn.ubuntu.com/4262-1/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4262-1/" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2019/12/11/8", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2019/12/11/8" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=946614", "reference_id": "946614", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=946614" }, { "reference_url": "https://github.com/advisories/GHSA-2j23-fwqm-mgwr", "reference_id": "GHSA-2j23-fwqm-mgwr", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-2j23-fwqm-mgwr" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/9733?format=api", "purl": "pkg:pypi/keystone@16.0.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ggr-pe4y-y3cn" }, { "vulnerability": "VCID-89vf-n61h-k3b2" }, { "vulnerability": "VCID-93vc-hgec-nfe6" }, { "vulnerability": "VCID-9dhg-r711-yfg6" }, { "vulnerability": "VCID-p5un-b12x-tuh5" }, { "vulnerability": "VCID-r25g-be38-b3be" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@16.0.1" } ], "aliases": [ "CVE-2019-19687", "GHSA-2j23-fwqm-mgwr", "PYSEC-2019-29" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-gdk6-a746-6fac" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/54457?format=api", "vulnerability_id": "VCID-p5un-b12x-tuh5", "summary": "OpenStack Keystone allows information disclosure during account locking\nOpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2021-38155", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00737", "scoring_system": "epss", "scoring_elements": "0.72775", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00737", "scoring_system": "epss", "scoring_elements": "0.72922", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00737", "scoring_system": "epss", "scoring_elements": "0.72925", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00737", "scoring_system": "epss", "scoring_elements": "0.72915", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00737", "scoring_system": "epss", "scoring_elements": "0.72874", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00737", "scoring_system": "epss", "scoring_elements": "0.72882", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00737", "scoring_system": "epss", "scoring_elements": "0.72872", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00737", "scoring_system": "epss", "scoring_elements": "0.72838", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00737", "scoring_system": "epss", "scoring_elements": "0.72855", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00737", "scoring_system": "epss", "scoring_elements": "0.72779", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00737", "scoring_system": "epss", "scoring_elements": "0.72802", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00737", "scoring_system": "epss", "scoring_elements": "0.72781", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00737", "scoring_system": "epss", "scoring_elements": "0.7283", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00737", "scoring_system": "epss", "scoring_elements": "0.72817", "published_at": "2026-04-08T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-38155" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38155", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38155" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/openstack/keystone", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/openstack/keystone" }, { "reference_url": "https://github.com/openstack/keystone/commit/1b573ae7d1c20e0ebfbde79bbe7538a09589c75d", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/openstack/keystone/commit/1b573ae7d1c20e0ebfbde79bbe7538a09589c75d" }, { "reference_url": "https://github.com/openstack/keystone/commit/8ab4eb27be4c13c9bab2b3ea700f00a190521bf8", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/openstack/keystone/commit/8ab4eb27be4c13c9bab2b3ea700f00a190521bf8" }, { "reference_url": "https://github.com/openstack/keystone/commit/ac2631ae33445877094cdae796fbcdce8833a626", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/openstack/keystone/commit/ac2631ae33445877094cdae796fbcdce8833a626" }, { "reference_url": "https://launchpad.net/bugs/1688137", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://launchpad.net/bugs/1688137" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00007.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2024/01/msg00007.html" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38155", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38155" }, { "reference_url": "https://security.openstack.org/ossa/OSSA-2021-003.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.openstack.org/ossa/OSSA-2021-003.html" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2021/08/10/5", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2021/08/10/5" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=992070", "reference_id": "992070", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=992070" }, { "reference_url": "https://github.com/advisories/GHSA-4225-97pr-rr52", "reference_id": "GHSA-4225-97pr-rr52", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-4225-97pr-rr52" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/81736?format=api", "purl": "pkg:pypi/keystone@16.0.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ggr-pe4y-y3cn" }, { "vulnerability": "VCID-89vf-n61h-k3b2" }, { "vulnerability": "VCID-93vc-hgec-nfe6" }, { "vulnerability": "VCID-9dhg-r711-yfg6" }, { "vulnerability": "VCID-r25g-be38-b3be" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@16.0.2" }, { "url": "http://public2.vulnerablecode.io/api/packages/81737?format=api", "purl": "pkg:pypi/keystone@17.0.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ggr-pe4y-y3cn" }, { "vulnerability": "VCID-89vf-n61h-k3b2" }, { "vulnerability": "VCID-93vc-hgec-nfe6" }, { "vulnerability": "VCID-9dhg-r711-yfg6" }, { "vulnerability": "VCID-r25g-be38-b3be" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@17.0.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/81738?format=api", "purl": "pkg:pypi/keystone@18.0.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@18.0.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/300566?format=api", "purl": "pkg:pypi/keystone@18.1.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ggr-pe4y-y3cn" }, { "vulnerability": "VCID-89vf-n61h-k3b2" }, { "vulnerability": "VCID-93vc-hgec-nfe6" }, { "vulnerability": "VCID-9dhg-r711-yfg6" }, { "vulnerability": "VCID-r25g-be38-b3be" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@18.1.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/81739?format=api", "purl": "pkg:pypi/keystone@19.0.1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-93vc-hgec-nfe6" }, { "vulnerability": "VCID-r25g-be38-b3be" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@19.0.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/300570?format=api", "purl": "pkg:pypi/keystone@20.0.0.0rc1", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ggr-pe4y-y3cn" }, { "vulnerability": "VCID-89vf-n61h-k3b2" }, { "vulnerability": "VCID-93vc-hgec-nfe6" }, { "vulnerability": "VCID-9dhg-r711-yfg6" }, { "vulnerability": "VCID-r25g-be38-b3be" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@20.0.0.0rc1" } ], "aliases": [ "CVE-2021-38155", "GHSA-4225-97pr-rr52" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-p5un-b12x-tuh5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/22337?format=api", "vulnerability_id": "VCID-r25g-be38-b3be", "summary": "OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.\nOpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-65073.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-65073.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2025-65073", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00026", "scoring_system": "epss", "scoring_elements": "0.07294", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00026", "scoring_system": "epss", "scoring_elements": "0.07287", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00026", "scoring_system": "epss", "scoring_elements": "0.07208", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00026", "scoring_system": "epss", "scoring_elements": "0.07329", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.00026", "scoring_system": "epss", "scoring_elements": "0.07203", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00031", "scoring_system": "epss", "scoring_elements": "0.08884", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00049", "scoring_system": "epss", "scoring_elements": "0.15193", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00049", "scoring_system": "epss", "scoring_elements": "0.15126", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00049", "scoring_system": "epss", "scoring_elements": "0.14999", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00049", "scoring_system": "epss", "scoring_elements": "0.15087", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00049", "scoring_system": "epss", "scoring_elements": "0.15139", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00049", "scoring_system": "epss", "scoring_elements": "0.15105", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00049", "scoring_system": "epss", "scoring_elements": "0.15067", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00049", "scoring_system": "epss", "scoring_elements": "0.15006", "published_at": "2026-04-13T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2025-65073" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65073", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65073" }, { "reference_url": "https://github.com/openstack/keystone", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/openstack/keystone" }, { "reference_url": "https://www.openwall.com/lists/oss-security/2025/11/04/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" }, { "value": "Track", "scoring_system": "ssvc", "scoring_elements": "SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-11-17T16:34:17Z/" } ], "url": "https://www.openwall.com/lists/oss-security/2025/11/04/2" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2025/11/17/6", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2025/11/17/6" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1120053", "reference_id": "1120053", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1120053" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=2415344", "reference_id": "2415344", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2415344" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65073", "reference_id": "CVE-2025-65073", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65073" }, { "reference_url": "https://github.com/advisories/GHSA-hcqg-5g63-7j9h", "reference_id": "GHSA-hcqg-5g63-7j9h", "reference_type": "", "scores": [ { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-hcqg-5g63-7j9h" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2026:1958", "reference_id": "RHSA-2026:1958", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2026:1958" }, { "reference_url": "https://usn.ubuntu.com/7926-1/", "reference_id": "USN-7926-1", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/7926-1/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/64930?format=api", "purl": "pkg:pypi/keystone@26.0.1", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@26.0.1" }, { "url": "http://public2.vulnerablecode.io/api/packages/64931?format=api", "purl": "pkg:pypi/keystone@27.0.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@27.0.0" }, { "url": "http://public2.vulnerablecode.io/api/packages/64932?format=api", "purl": "pkg:pypi/keystone@28.0.0", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@28.0.0" } ], "aliases": [ "CVE-2025-65073", "GHSA-hcqg-5g63-7j9h" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-r25g-be38-b3be" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/6079?format=api", "vulnerability_id": "VCID-w6e4-zd31-g7hu", "summary": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-12690.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-12690.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-12690", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00817", "scoring_system": "epss", "scoring_elements": "0.74414", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.00817", "scoring_system": "epss", "scoring_elements": "0.74415", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.00817", "scoring_system": "epss", "scoring_elements": "0.74407", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.00817", "scoring_system": "epss", "scoring_elements": "0.74288", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.00817", "scoring_system": "epss", "scoring_elements": "0.7438", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.00817", "scoring_system": "epss", "scoring_elements": "0.74372", "published_at": "2026-04-16T12:55:00Z" }, { "value": "0.00817", "scoring_system": "epss", "scoring_elements": "0.74335", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.00817", "scoring_system": "epss", "scoring_elements": "0.74343", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.00817", "scoring_system": "epss", "scoring_elements": "0.74363", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.00817", "scoring_system": "epss", "scoring_elements": "0.74342", "published_at": "2026-04-09T12:55:00Z" }, { "value": "0.00817", "scoring_system": "epss", "scoring_elements": "0.74327", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.00817", "scoring_system": "epss", "scoring_elements": "0.74294", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.00817", "scoring_system": "epss", "scoring_elements": "0.74321", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.00817", "scoring_system": "epss", "scoring_elements": "0.74293", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.00817", "scoring_system": "epss", "scoring_elements": "0.74373", "published_at": "2026-04-21T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-12690" }, { "reference_url": "https://bugs.launchpad.net/keystone/+bug/1873290", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugs.launchpad.net/keystone/+bug/1873290" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12689", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12689" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12690", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12690" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12691", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12691" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12692", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12692" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.3", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/advisories/GHSA-6m8p-x4qw-gh5j", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "HIGH", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-6m8p-x4qw-gh5j" }, { "reference_url": "https://github.com/openstack/keystone", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/openstack/keystone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2020-54.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2020-54.yaml" }, { "reference_url": "https://lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2@%3Ccommits.druid.apache.org%3E", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.apache.org/thread.html/re4ffc55cd2f1b55a26e07c83b3c22c3fe4bae6054d000a57fb48d8c2@%3Ccommits.druid.apache.org%3E" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12690", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12690" }, { "reference_url": "https://security.openstack.org/ossa/OSSA-2020-005.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.openstack.org/ossa/OSSA-2020-005.html" }, { "reference_url": "https://usn.ubuntu.com/4480-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/4480-1" }, { "reference_url": "https://usn.ubuntu.com/4480-1/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4480-1/" }, { "reference_url": "https://www.openwall.com/lists/oss-security/2020/05/06/6", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.openwall.com/lists/oss-security/2020/05/06/6" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2020/05/07/3", "reference_id": "", "reference_type": "", "scores": [ { "value": "8.8", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H" }, { "value": "8.7", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2020/05/07/3" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1830395", "reference_id": "1830395", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1830395" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=959900", "reference_id": "959900", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=959900" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:3102", "reference_id": "RHSA-2020:3102", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:3102" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:3105", "reference_id": "RHSA-2020:3105", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:3105" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/9732?format=api", "purl": "pkg:pypi/keystone@16.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ggr-pe4y-y3cn" }, { "vulnerability": "VCID-769v-tw47-rucm" }, { "vulnerability": "VCID-89vf-n61h-k3b2" }, { "vulnerability": "VCID-93vc-hgec-nfe6" }, { "vulnerability": "VCID-9dhg-r711-yfg6" }, { "vulnerability": "VCID-gdk6-a746-6fac" }, { "vulnerability": "VCID-p5un-b12x-tuh5" }, { "vulnerability": "VCID-qyjh-md45-hyhh" }, { "vulnerability": "VCID-r25g-be38-b3be" }, { "vulnerability": "VCID-rgkw-6ews-rked" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@16.0.0" } ], "aliases": [ "CVE-2020-12690", "GHSA-6m8p-x4qw-gh5j", "PYSEC-2020-54" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-w6e4-zd31-g7hu" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/6077?format=api", "vulnerability_id": "VCID-wc5s-25xb-rqaa", "summary": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times.", "references": [ { "reference_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-12692.json", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" } ], "url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-12692.json" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2020-12692", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.0014", "scoring_system": "epss", "scoring_elements": "0.33675", "published_at": "2026-04-29T12:55:00Z" }, { "value": "0.0014", "scoring_system": "epss", "scoring_elements": "0.33762", "published_at": "2026-04-26T12:55:00Z" }, { "value": "0.0014", "scoring_system": "epss", "scoring_elements": "0.33785", "published_at": "2026-04-24T12:55:00Z" }, { "value": "0.0014", "scoring_system": "epss", "scoring_elements": "0.33931", "published_at": "2026-04-01T12:55:00Z" }, { "value": "0.0014", "scoring_system": "epss", "scoring_elements": "0.34174", "published_at": "2026-04-13T12:55:00Z" }, { "value": "0.0014", "scoring_system": "epss", "scoring_elements": "0.34197", "published_at": "2026-04-12T12:55:00Z" }, { "value": "0.0014", "scoring_system": "epss", "scoring_elements": "0.34238", "published_at": "2026-04-11T12:55:00Z" }, { "value": "0.0014", "scoring_system": "epss", "scoring_elements": "0.34209", "published_at": "2026-04-08T12:55:00Z" }, { "value": "0.0014", "scoring_system": "epss", "scoring_elements": "0.34166", "published_at": "2026-04-07T12:55:00Z" }, { "value": "0.0014", "scoring_system": "epss", "scoring_elements": "0.34303", "published_at": "2026-04-04T12:55:00Z" }, { "value": "0.0014", "scoring_system": "epss", "scoring_elements": "0.3427", "published_at": "2026-04-02T12:55:00Z" }, { "value": "0.0014", "scoring_system": "epss", "scoring_elements": "0.34158", "published_at": "2026-04-21T12:55:00Z" }, { "value": "0.0014", "scoring_system": "epss", "scoring_elements": "0.34194", "published_at": "2026-04-18T12:55:00Z" }, { "value": "0.0014", "scoring_system": "epss", "scoring_elements": "0.34207", "published_at": "2026-04-16T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-12692" }, { "reference_url": "https://bugs.launchpad.net/keystone/+bug/1872737", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://bugs.launchpad.net/keystone/+bug/1872737" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12689", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12689" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12690", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12690" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12691", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12691" }, { "reference_url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12692", "reference_id": "", "reference_type": "", "scores": [], "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12692" }, { "reference_url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "7", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H" } ], "url": "https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml" }, { "reference_url": "https://github.com/openstack/keystone", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/openstack/keystone" }, { "reference_url": "https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2020-56.yaml", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2020-56.yaml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12692", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12692" }, { "reference_url": "https://opendev.org/openstack/keystone/commit/ab89ea749013e7f2c46260f68504f5687763e019", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://opendev.org/openstack/keystone/commit/ab89ea749013e7f2c46260f68504f5687763e019" }, { "reference_url": "https://security.openstack.org/ossa/OSSA-2020-003.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://security.openstack.org/ossa/OSSA-2020-003.html" }, { "reference_url": "https://usn.ubuntu.com/4480-1", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://usn.ubuntu.com/4480-1" }, { "reference_url": "https://usn.ubuntu.com/4480-1/", "reference_id": "", "reference_type": "", "scores": [], "url": "https://usn.ubuntu.com/4480-1/" }, { "reference_url": "https://www.openwall.com/lists/oss-security/2020/05/06/4", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.openwall.com/lists/oss-security/2020/05/06/4" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2020/05/07/1", "reference_id": "", "reference_type": "", "scores": [ { "value": "5.4", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N" }, { "value": "5.3", "scoring_system": "cvssv4", "scoring_elements": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2020/05/07/1" }, { "reference_url": "https://bugzilla.redhat.com/show_bug.cgi?id=1833164", "reference_id": "1833164", "reference_type": "", "scores": [], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1833164" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=959900", "reference_id": "959900", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=959900" }, { "reference_url": "https://github.com/advisories/GHSA-rqw2-hhrf-7936", "reference_id": "GHSA-rqw2-hhrf-7936", "reference_type": "", "scores": [ { "value": "MODERATE", "scoring_system": "cvssv3.1_qr", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-rqw2-hhrf-7936" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:2732", "reference_id": "RHSA-2020:2732", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:2732" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:3102", "reference_id": "RHSA-2020:3102", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:3102" }, { "reference_url": "https://access.redhat.com/errata/RHSA-2020:3105", "reference_id": "RHSA-2020:3105", "reference_type": "", "scores": [], "url": "https://access.redhat.com/errata/RHSA-2020:3105" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/9732?format=api", "purl": "pkg:pypi/keystone@16.0.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-2ggr-pe4y-y3cn" }, { "vulnerability": "VCID-769v-tw47-rucm" }, { "vulnerability": "VCID-89vf-n61h-k3b2" }, { "vulnerability": "VCID-93vc-hgec-nfe6" }, { "vulnerability": "VCID-9dhg-r711-yfg6" }, { "vulnerability": "VCID-gdk6-a746-6fac" }, { "vulnerability": "VCID-p5un-b12x-tuh5" }, { "vulnerability": "VCID-qyjh-md45-hyhh" }, { "vulnerability": "VCID-r25g-be38-b3be" }, { "vulnerability": "VCID-rgkw-6ews-rked" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@16.0.0" } ], "aliases": [ "CVE-2020-12692", "GHSA-rqw2-hhrf-7936", "PYSEC-2020-56" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-wc5s-25xb-rqaa" } ], "fixing_vulnerabilities": [], "risk_score": "4.5", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@16.0.0.0rc2" }