PYSEC-2026-911

Dashboard / Vulnerabilities / PYSEC-2026-911

PYSEC-2026-911

Published: 6 Jul 2026Last Modified: 7 Jul 2026

Aliases:

CVE-2013-2030

Summary: OpenStack Nova uses insecure keystone middleware tmpdir by default

Details: keystone/middleware/auth_token.py in OpenStack Nova Folsom, Grizzly, and Havana uses an insecure temporary directory for storing signing certificates, which allows local users to spoof servers by pre-creating this directory, which is reused by Nova, as demonstrated using /tmp/keystone-signing-nova on Fedora.

References: https://nvd.nist.gov/vuln/detail/CVE-2013-2030, https://github.com/openstack/nova/commit/58d6879b1caaa750c39c8e452a0634c24ffef2ce, https://github.com/openstack/nova/commit/74aa04e2ca7942cb1e1a86dcbaffeb72d260ccd7, https://github.com/openstack/nova/commit/7bf3e8d3e254d817ff5ae7ef1f2884b10410ca60, https://github.com/openstack/python-keystoneclient/commit/1736e2ffb12f70eeebed019448bc14def48aa036, https://bugs.launchpad.net/nova/+bug/1174608, https://bugzilla.redhat.com/show_bug.cgi?id=958285, https://github.com/openstack/nova, https://github.com/pypa/advisory-database/tree/main/vulns/nova/PYSEC-2013-45.yaml, http://lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html, http://lists.openstack.org/pipermail/openstack-announce/2013-May/000098.html, http://www.openwall.com/lists/oss-security/2013/05/09/2, https://pypi.org/project/python-keystoneclient, https://github.com/advisories/GHSA-pxxv-rv32-2qgv

Affected packages

Package

Name: python-keystoneclient

Purl: pkg:pypi/python-keystoneclient

Affected ranges

Type: ECOSYSTEM

Events:

Introduced- 0

Fixed -0.2.4

Affected versions

0.1.1

0.1.2

0.1.3

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High