Search for packages
| purl | pkg:pypi/keystone@12.0.2 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 4.1 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
CVE-2015-3646
Aliases: GHSA-jwpw-ppj5-7h4w |
Exposure of Sensitive Information to an Unauthorized Actor OpenStack Identity (Keystone) before 2014.1.5 and 2014.2.x before 2014.2.4 logs the backend_argument … | There are no reported fixed by versions. |
|
CVE-2013-4477
|
Permission Issues The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for … | There are no reported fixed by versions. |
|
PYSEC-2019-99
|
OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role … |
Vulnerable |
|
PYSEC-2018-9
Aliases: CVE-2018-20170 |
** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than … |
Vulnerable |
|
PYSEC-2020-54
Aliases: CVE-2020-12690 GHSA-6m8p-x4qw-gh5j |
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access … |
Vulnerable |
|
GHSA-6m8p-x4qw-gh5j
Aliases: CVE-2020-12690 |
Insufficient Session Expiration in OpenStack Keystone An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of … |
Vulnerable |
|
GHSA-4225-97pr-rr52
Aliases: CVE-2021-38155 |
OpenStack Keystone allows information disclosure during account locking OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before … |
Vulnerable |
|
GHSA-chgw-36xv-47cw
Aliases: CVE-2020-12689 |
OpenStack Keystone EC2 and/or credential endpoints are not protected from a scoped context An issue was discovered in OpenStack Keystone … |
Vulnerable |
|
GHSA-4427-7f3w-mqv6
Aliases: CVE-2020-12691 |
OpenStack Keystone V3 /credentials endpoint policy logic allows to change credentials owner or target project ID An issue was discovered … |
Vulnerable |
|
GHSA-gf2q-j2qq-pjf2
Aliases: CVE-2012-3542 |
OpenStack Keystone Allows Remote User Account Creation OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), … | There are no reported fixed by versions. |
|
GHSA-rqw2-hhrf-7936
Aliases: CVE-2020-12692 |
OpenStack Keystone does not check signature TTL of the EC2 credential auth method An issue was discovered in OpenStack Keystone … |
Vulnerable |
|
PYSEC-2012-19
Aliases: CVE-2012-3542 GHSA-gf2q-j2qq-pjf2 |
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary … | There are no reported fixed by versions. |
|
PYSEC-2012-20
Aliases: CVE-2012-5563 GHSA-w66p-78g4-mr7g |
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to … | There are no reported fixed by versions. |
|
PYSEC-2012-34
Aliases: CVE-2012-3426 GHSA-xp97-6w7r-4cjc |
OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, … | There are no reported fixed by versions. |
|
PYSEC-2012-35
Aliases: CVE-2012-5571 GHSA-qvpr-qm6w-6rcc |
OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed … | There are no reported fixed by versions. |
|
PYSEC-2013-40
Aliases: CVE-2013-2006 GHSA-rxrm-xvp4-jqvh |
OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in … | There are no reported fixed by versions. |
|
PYSEC-2019-29
Aliases: CVE-2019-19687 GHSA-2j23-fwqm-mgwr |
OpenStack Keystone 15.0.0 and 16.0.0 is affected by Data Leakage in the list credentials API. Any user with a role … |
Vulnerable |
|
PYSEC-2012-34
Aliases: CVE-2012-3426 GHSA-xp97-6w7r-4cjc |
OpenStack Keystone before 2012.1.1, as used in OpenStack Folsom before Folsom-1 and OpenStack Essex, does not properly implement token expiration, … | There are no reported fixed by versions. |
|
PYSEC-2020-56
Aliases: CVE-2020-12692 GHSA-rqw2-hhrf-7936 |
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check … |
Vulnerable |
|
PYSEC-2012-35
Aliases: CVE-2012-5571 GHSA-qvpr-qm6w-6rcc |
OpenStack Keystone Essex (2012.1) and Folsom (2012.2) does not properly handle EC2 tokens when the user role has been removed … | There are no reported fixed by versions. |
|
PYSEC-2013-40
Aliases: CVE-2013-2006 GHSA-rxrm-xvp4-jqvh |
OpenStack Identity (Keystone) Grizzly 2013.1.1, when DEBUG mode logging is enabled, logs the (1) admin_token and (2) LDAP password in … | There are no reported fixed by versions. |
|
PYSEC-2012-20
Aliases: CVE-2012-5563 GHSA-w66p-78g4-mr7g |
OpenStack Keystone, as used in OpenStack Folsom 2012.2, does not properly implement token expiration, which allows remote authenticated users to … | There are no reported fixed by versions. |
|
PYSEC-2012-19
Aliases: CVE-2012-3542 GHSA-gf2q-j2qq-pjf2 |
OpenStack Keystone, as used in OpenStack Folsom before folsom-rc1 and OpenStack Essex (2012.1), allows remote attackers to add an arbitrary … | There are no reported fixed by versions. |
|
PYSEC-2020-55
Aliases: CVE-2020-12691 GHSA-4427-7f3w-mqv6 |
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for … |
Vulnerable |
|
PYSEC-2020-53
Aliases: CVE-2020-12689 GHSA-chgw-36xv-47cw |
An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) … |
Vulnerable |
|
PYSEC-2026-1490
Aliases: CVE-2025-65073 GHSA-hcqg-5g63-7j9h |
OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization. OpenStack Keystone before 26.0.1, 27.0.0, … |
Vulnerable Vulnerable |
|
PYSEC-2026-830
Aliases: CVE-2021-38155 GHSA-4225-97pr-rr52 |
OpenStack Keystone allows information disclosure during account locking OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before … |
Vulnerable Vulnerable Vulnerable |
|
PYSEC-2026-833
Aliases: CVE-2012-4413 GHSA-mrxv-65rv-6hxq |
OpenStack Keystone does not invalidate existing tokens when granting or revoking roles OpenStack Keystone before 2012.1.3 does not invalidate existing … | There are no reported fixed by versions. |
|
PYSEC-2026-370
Aliases: CVE-2021-3563 GHSA-cc99-whm5-mmq3 |
Openstack Keystone Incorrect Authorization vulnerability A flaw was found in openstack-keystone, only the first 72 characters of an application secret … | There are no reported fixed by versions. |
|
PYSEC-2026-2550
Aliases: CVE-2026-40683 GHSA-pfx2-9x9m-7ghx |
OpenStack Keystone: LDAP identity backend does not convert enabled attribute to boolean In OpenStack Keystone before 28.0.1, the LDAP identity … |
Vulnerable |