Home

CVE-2021-38155

Description

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that accounts corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.

Risk Information

Base Score
7.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS Score
Exploitation Probability
1.158

Associated Vulnerability

VulnerabilityOS Platform
Vulnerabilities CVE-2021-38155 are fixed in Python-keystone 16.0.2Windows
Vulnerabilities CVE-2021-38155 are fixed in Python-keystone 17.0.1Windows
Vulnerabilities CVE-2021-38155 are fixed in Python-keystone 18.0.1Windows
Vulnerabilities CVE-2021-38155 are fixed in Python-keystone 19.0.1Windows
Vulnerabilities CVE-2021-38155 are fixed in Python-keystone for linux 16.0.2Linux
Vulnerabilities CVE-2021-38155 are fixed in Python-keystone for linux 17.0.1Linux
Vulnerabilities CVE-2021-38155 are fixed in Python-keystone for linux 18.0.1Linux
Vulnerabilities CVE-2021-38155 are fixed in Python-keystone for linux 19.0.1Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234