CVE-2014-0105: openstack python-keystoneclient Credentials Management Errors
Vulnerability summary
CVE-2014-0105 is a medium (CVSS 6.0) Credentials Management Errors vulnerability in openstack python-keystoneclient. EPSS estimates a 1.10% chance of exploitation in the next 30 days, higher than 65.1% of scored vulnerabilities.
Timeline
- 15-04-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."
CVSS metrics
3 scores · 2 sources · 3 versionsEPSS trend
Probability
1.10%
Chance of exploitation in the next 30 days
Percentile
65%
Versus all other CVEs
30-day change
0.00 pp
From 1.10% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat3 products
- python-keystoneclient< 1:0.7.1-2.el6ost | < 1:0.2.3-8.el6ost
- python-keystoneclient-doc< 1:0.7.1-2.el6ost | < 1:0.2.3-8.el6ost
- python-six< 0:1.5.2-1.el6
Debian2 products
- keystone< 2013.1.1-2
- python-keystoneclient< 1:0.6.0-4
Ubuntu2 products
- keystone< 1:2014.1-0ubuntu1
- python-keystoneclient< 1:0.7.1-ubuntu1
Openstack1 product
- python-keystoneclient≤ 0.4.2 | 0.2.2 | 0.2.3 | 0.2.4 | 0.3.0 | 0.3.1 | 0.3.2
PyPI1 product
- python-keystoneclient< 0.7.0
5 vendors · 9 products
