Python-Keystoneclient vulnerabilitiesRanked by how likely they are to be used.
Python-Keystoneclient is made by Openstack. We track 7 published vulnerabilities in it, across 21 versions. None of them is on the list of flaws known to be exploited today. If you run Python-Keystoneclient, keep it on a version the vendor still supports.
We keep watching the known-exploited list.
Which Python-Keystoneclient vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Python-Keystoneclient's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Python-Keystoneclient flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 2.6%CVE-2015-1852Medium
The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini)...
- 2.1%CVE-2013-2166Critical
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass
- 2.1%CVE-2013-2104Medium
python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remote authenticated users to (1) retain use of a token after it has expired, or...
- 2.0%CVE-2014-7144Medium
OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file...
- 2.0%CVE-2013-2167Critical
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass
- 1.1%CVE-2014-0105Medium
The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to...
- 0.4%
The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process.
Running Python-Keystoneclient? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the "insecure" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.
- Matched to
- Python-Keystoneclient on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 7 published vulnerabilities listed under the name Python-Keystoneclient, across 21 versions.
None of Python-Keystoneclient's vulnerabilities is on the list of flaws known to be exploited today.
Create a Precursor Intelligence account and track Python-Keystoneclient. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.