CVE-2018-20170

    Dashboard / Vulnerabilities / CVE-2018-20170

    CVE-2018-20170

    Published: 17 Dec 2018Last Modified: 8 Jul 2026
    Aliases:
    PYSEC-2018-9

    Summary:

    Details: OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory

    References: https://bugs.launchpad.net/keystone/+bug/1795800

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    14.0.0.0rc2
    14.0.0
    14.0.1
    14.0.0.0rc1
    14.0.0.0b2
    14.0.0.0b1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2018-20170 | CVE-DB