What is CVE-2018-20170 vulnerability?

CVE-2018-20170 is a user enumeration vulnerability in OpenStack Keystone through version 14.0.1, allowing attackers to determine valid usernames by observing differences in response times.

What is the severity of CVE-2018-20170?

The severity of CVE-2018-20170 is medium with a CVSS score of 5.3.

How does CVE-2018-20170 work?

CVE-2018-20170 works by exploiting the fact that invalid usernames generate faster responses than valid ones, allowing attackers to enumerate valid usernames through timing differences.

Is there a fix for CVE-2018-20170 vulnerability?

At the time of writing, there is no official fix available for CVE-2018-20170. However, the vendor considers this as a hardening opportunity rather than a critical security issue.

Where can I find more information about CVE-2018-20170?

You can find more information about CVE-2018-20170 at the following reference: https://bugs.launchpad.net/keystone/+bug/1795800

Vulnerability/
CVE-2018-20170

medium

5.3

CWE

200

17/12/2018

5/8/2024

CVE-2018-20170: Infoleak

First published: Mon Dec 17 2018(Updated: )

** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory.

Credit: cve@mitre.org cve@mitre.org

Affected Software	Affected Version	How to fix
OpenStack Keystone	<=14.0.1
	<=14.0.1

Never miss a vulnerability like this again

Reference Links

https://bugs.launchpad.net/keystone/+bug/1795800

Frequently Asked Questions

What is CVE-2018-20170 vulnerability?
CVE-2018-20170 is a user enumeration vulnerability in OpenStack Keystone through version 14.0.1, allowing attackers to determine valid usernames by observing differences in response times.
What is the severity of CVE-2018-20170?
The severity of CVE-2018-20170 is medium with a CVSS score of 5.3.
How does CVE-2018-20170 work?
CVE-2018-20170 works by exploiting the fact that invalid usernames generate faster responses than valid ones, allowing attackers to enumerate valid usernames through timing differences.
Is there a fix for CVE-2018-20170 vulnerability?
At the time of writing, there is no official fix available for CVE-2018-20170. However, the vendor considers this as a hardening opportunity rather than a critical security issue.
Where can I find more information about CVE-2018-20170?
You can find more information about CVE-2018-20170 at the following reference: https://bugs.launchpad.net/keystone/+bug/1795800

collector/nvd-index
agent/type
agent/first-publish-date
agent/severity
agent/weakness
agent/references
agent/author
agent/status
agent/softwarecombine
agent/description
agent/event
agent/tags
collector/nvd-api
source/NVD
agent/software-canonical-lookup
agent/last-modified-date
collector/mitre-cve
source/MITRE
status/disputed
vendor/openstack
canonical/openstack keystone
version/openstack keystone/14.0.1

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.