CVE-2018-20170: Infoleak
DISPUTED OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-20170 vulnerability?
CVE-2018-20170 is a user enumeration vulnerability in OpenStack Keystone through version 14.0.1, allowing attackers to determine valid usernames by observing differences in response times.
What is the severity of CVE-2018-20170?
The severity of CVE-2018-20170 is medium with a CVSS score of 5.3.
How does CVE-2018-20170 work?
CVE-2018-20170 works by exploiting the fact that invalid usernames generate faster responses than valid ones, allowing attackers to enumerate valid usernames through timing differences.
Is there a fix for CVE-2018-20170 vulnerability?
At the time of writing, there is no official fix available for CVE-2018-20170. However, the vendor considers this as a hardening opportunity rather than a critical security issue.
Where can I find more information about CVE-2018-20170?
You can find more information about CVE-2018-20170 at the following reference: https://bugs.launchpad.net/keystone/+bug/1795800