Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 10 Aug 2021 14:54:41 +0000
From: Jeremy Stanley <>
Subject: [OSSA-2021-003] Keystone: Account name and UUID oracles in account
 locking (CVE-2021-38155)

OSSA-2021-003: Account name and UUID oracles in account locking

:Date: August 10, 2021
:CVE: CVE-2021-38155

- Keystone: >=10.0.0 <16.0.2, >=17.0.0 <17.0.1, >=18.0.0 <18.0.1, >=19.0.0 <19.0.1

Samuel de Medeiros Queiroz with Oi Cloud reported a vulnerability
affecting Keystone account locking. By guessing the name of an
account and failing to authenticate multiple times, any
unauthenticated actor could both confirm the account exists and
obtain that account's corresponding UUID, which might be leveraged
for other unrelated attacks. All Keystone deployments enabling
security_compliance.lockout_failure_attempts are affected.

- (Train)
- (Ussuri)
- (Victoria)
- (Wallaby)
- (Xena)

- Samuel de Medeiros Queiroz from Oi Cloud (CVE-2021-38155)


Jeremy Stanley

Download attachment "signature.asc" of type "application/pgp-signature" (964 bytes)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.