CVE-2014-0105 in OpenStack python-keystoneclient
Summary
The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Reservation
12/03/2013
Disclosure
04/15/2014
Entries
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerability | CWE | Exp | Cou | CVE |
|---|---|---|---|---|---|
| 69333 | OpenStack python-keystoneclient Privileges credentials management | 255 | Not defined | Official fix | CVE-2014-0105 |