CVE-2021-38155: High severity Openstack Keystone vulnerability

Q: What is CVE-2021-38155?

CVE-2021-38155 is a vulnerability in OpenStack Keystone versions 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1.

Q: What is the severity of CVE-2021-38155?

The severity of CVE-2021-38155 is high, with a severity value of 7.5.

Q: How does CVE-2021-38155 allow information disclosure?

CVE-2021-38155 allows information disclosure during account locking by guessing the name of an account and failing to authenticate multiple times.

Q: Which versions of OpenStack Keystone are affected by CVE-2021-38155?

OpenStack Keystone versions 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 are affected by CVE-2021-38155.

Q: Where can I find more information about CVE-2021-38155?

You can find more information about CVE-2021-38155 at the following references: [1] http://www.openwall.com/lists/oss-security/2021/08/10/5 [2] https://launchpad.net/bugs/1688137 [3] https://security.openstack.org/ossa/OSSA-2021-003.html

Published Aug 6, 2021

Updated

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling securitycompliance.lockoutfailureattempts are affected.

Affected Software

8 affected componentsFixes available

pip/keystone>=19.0<19.0.1

19.0.1

pip/keystone>=18.0<18.0.1

18.0.1

pip/keystone>=17.0<17.0.1

17.0.1

pip/keystone>=10.0<16.0.2

16.0.2

Openstack Keystone>=10.0.0<16.0.2

Openstack Keystone>=17.0.0<17.0.1

Openstack Keystone>=18.0.0<18.0.1

Openstack Keystone>=19.0.0<19.0.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pip/keystone to a version that resolves this vulnerability.
Fixed in 19.0.1
Upgrade
Upgrade pip/keystone to a version that resolves this vulnerability.
Fixed in 18.0.1
Upgrade
Upgrade pip/keystone to a version that resolves this vulnerability.
Fixed in 17.0.1
Upgrade
Upgrade pip/keystone to a version that resolves this vulnerability.
Fixed in 16.0.2
Upgrade
Upgrade OpenStack Keystone to a version that resolves this vulnerability.
Fixed in 16.0.2
Upgrade
Upgrade OpenStack Keystone to a version that resolves this vulnerability.
Fixed in 17.0.1
Upgrade
Upgrade OpenStack Keystone to a version that resolves this vulnerability.
Fixed in 18.0.1
Upgrade
Upgrade OpenStack Keystone to a version that resolves this vulnerability.
Fixed in 19.0.1
Configuration
If enabled (deployments with this setting enabled are affected), update Keystone to a fixed release listed in this advisory to prevent information disclosure during account locking.
OpenStack Keystone security_compliance.lockout_failure_attempts = not specified

Event History

Aug 6, 2021

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

May 24, 2022

Advisory Published

via GitHub·07:10 PM

Frequently Asked Questions

What is CVE-2021-38155?

CVE-2021-38155 is a vulnerability in OpenStack Keystone versions 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1.

What is the severity of CVE-2021-38155?

The severity of CVE-2021-38155 is high, with a severity value of 7.5.

How does CVE-2021-38155 allow information disclosure?

CVE-2021-38155 allows information disclosure during account locking by guessing the name of an account and failing to authenticate multiple times.

Which versions of OpenStack Keystone are affected by CVE-2021-38155?