CVE-2013-2167

Publication date 10 December 2019

Last updated 24 July 2024

Ubuntu priority

Medium

Why this priority?

Cvss 3 Severity Score

9.8 · Critical

Score breakdown

python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass

Read the notes from the security team

Status

Package Ubuntu Release Status
python-keystoneclient 13.04 raring Ignored
12.10 quantal
Not affected
12.04 LTS precise
Not affected
10.04 LTS lucid Not in release

Notes

jdstrand

per upstream, feature exposing this bug was introduced in Grizzly as an optional feature fix for CVE-2013-2166 implemented in this patchset per upstream, patch is forward compatible, but will invalidate any existing ephemeral encrypted or signed memcache entries. This is too disruptive for a stable release update

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
python-keystoneclient

Severity score breakdown

Parameter Value
Base score 9.8 · Critical
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H