CVE-2018-20170

Published: 17 December 2018

** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory.

Notes

Author	Note
mdeslaur	disputed, marking as ignored

Priority

Cvss 3 Severity Score

5.3

Score breakdown

Status

Package	Release	Status
keystone Launchpad, Ubuntu, Debian	bionic	Ignored
	cosmic	Ignored (end of life)
	disco	Ignored
	eoan	Ignored
	trusty	Does not exist (trusty was needs-triage)
	upstream	Needs triage
	xenial	Ignored

Severity score breakdown

Parameter	Value
Base score	5.3
Attack vector	Network
Attack complexity	Low
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	Low
Integrity impact	None
Availability impact	None
Vector	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›