{"url":"http://public2.vulnerablecode.io/api/vulnerabilities/35297?format=json","vulnerability_id":"VCID-zvfa-f3nf-gqh8","summary":"** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory.","aliases":[{"alias":"CVE-2018-20170"},{"alias":"PYSEC-2018-9"}],"fixed_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/12612?format=json","purl":"pkg:pypi/keystone@14.1.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@14.1.0"}],"affected_packages":[{"url":"http://public2.vulnerablecode.io/api/packages/12605?format=json","purl":"pkg:pypi/keystone@12.0.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"},{"vulnerability":"VCID-zvfa-f3nf-gqh8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@12.0.2"},{"url":"http://public2.vulnerablecode.io/api/packages/12606?format=json","purl":"pkg:pypi/keystone@12.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"},{"vulnerability":"VCID-zvfa-f3nf-gqh8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@12.0.3"},{"url":"http://public2.vulnerablecode.io/api/packages/12607?format=json","purl":"pkg:pypi/keystone@13.0.2","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"},{"vulnerability":"VCID-zvfa-f3nf-gqh8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@13.0.2"},{"url":"http://public2.vulnerablecode.io/api/packages/12608?format=json","purl":"pkg:pypi/keystone@13.0.3","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"},{"vulnerability":"VCID-zvfa-f3nf-gqh8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@13.0.3"},{"url":"http://public2.vulnerablecode.io/api/packages/12609?format=json","purl":"pkg:pypi/keystone@13.0.4","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"},{"vulnerability":"VCID-zvfa-f3nf-gqh8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@13.0.4"},{"url":"http://public2.vulnerablecode.io/api/packages/12610?format=json","purl":"pkg:pypi/keystone@14.0.0","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"},{"vulnerability":"VCID-zvfa-f3nf-gqh8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@14.0.0"},{"url":"http://public2.vulnerablecode.io/api/packages/12611?format=json","purl":"pkg:pypi/keystone@14.0.1","is_vulnerable":true,"affected_by_vulnerabilities":[{"vulnerability":"VCID-72xb-qu9g-wufj"},{"vulnerability":"VCID-91yw-81v7-jbay"},{"vulnerability":"VCID-kd2c-53va-qbcg"},{"vulnerability":"VCID-u4kn-nadh-wqbk"},{"vulnerability":"VCID-vr3n-ae3v-mqgz"},{"vulnerability":"VCID-zvfa-f3nf-gqh8"}],"resource_url":"http://public2.vulnerablecode.io/packages/pkg:pypi/keystone@14.0.1"}],"references":[{"reference_url":"https://bugs.launchpad.net/keystone/+bug/1795800","reference_id":"","reference_type":"","scores":[],"url":"https://bugs.launchpad.net/keystone/+bug/1795800"}],"weaknesses":[],"exploits":[],"severity_range_score":null,"exploitability":null,"weighted_severity":null,"risk_score":null,"resource_url":"http://public2.vulnerablecode.io/vulnerabilities/VCID-zvfa-f3nf-gqh8"}