Skip to content
Heist/ feed
UnratedFix available

UBUNTU-CVE-2021-3563

Type: advisorySource: OSV1 source record

A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.

Announced Source revision 1
Original source ↗

UBUNTU-CVE-2021-3563

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: osv:UBUNTU-CVE-2021-3563

keystone

Source reference: /affected/0/package/name

Affected versions
2:8.0.0-0ubuntu1

Source reference: /affected/0/versions

2:9.0.0~b1-0ubuntu1

Source reference: /affected/0/versions

2:9.0.0~b2-0ubuntu1

Source reference: /affected/0/versions

2:9.0.0~b3-0ubuntu1

Source reference: /affected/0/versions

2:9.0.0~rc1-0ubuntu1

Source reference: /affected/0/versions

2:9.0.0-0ubuntu1

Source reference: /affected/0/versions

2:9.0.2-0ubuntu1

Source reference: /affected/0/versions

2:9.0.2-0ubuntu2

Source reference: /affected/0/versions

2:9.1.0-0ubuntu1

Source reference: /affected/0/versions

2:9.2.0-0ubuntu1

Source reference: /affected/0/versions

2:9.3.0-0ubuntu1

Source reference: /affected/0/versions

2:9.3.0-0ubuntu2

Source reference: /affected/0/versions

2:9.3.0-0ubuntu3

Source reference: /affected/0/versions

2:9.3.0-0ubuntu3.1

Source reference: /affected/0/versions

2:9.3.0-0ubuntu3.2

Source reference: /affected/0/versions

2:9.3.0-0ubuntu3.2+esm2

Source reference: /affected/0/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

keystone

Source reference: /affected/1/package/name

Affected versions
2:12.0.0-0ubuntu1

Source reference: /affected/1/versions

2:13.0.0~b1-0ubuntu1

Source reference: /affected/1/versions

2:13.0.0~b2-0ubuntu1

Source reference: /affected/1/versions

2:13.0.0~b3-0ubuntu1

Source reference: /affected/1/versions

2:13.0.0~rc1-0ubuntu1

Source reference: /affected/1/versions

2:13.0.0~rc2-0ubuntu1

Source reference: /affected/1/versions

2:13.0.0-0ubuntu1

Source reference: /affected/1/versions

2:13.0.1-0ubuntu1

Source reference: /affected/1/versions

2:13.0.2-0ubuntu1

Source reference: /affected/1/versions

2:13.0.2-0ubuntu3

Source reference: /affected/1/versions

2:13.0.4-0ubuntu1

Source reference: /affected/1/versions

2:13.0.4-0ubuntu1+esm1

Source reference: /affected/1/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

keystone

Source reference: /affected/2/package/name

Affected versions
2:16.0.0-0ubuntu1

Source reference: /affected/2/versions

2:17.0.0~b1~git2019121613.db81fee63-0ubuntu1

Source reference: /affected/2/versions

2:17.0.0~b2~git2020020513.99733f172-0ubuntu1

Source reference: /affected/2/versions

2:17.0.0~b3~git2020032415.9f9040257-0ubuntu1

Source reference: /affected/2/versions

2:17.0.0~b3~git2020032415.9f9040257-0ubuntu2

Source reference: /affected/2/versions

2:17.0.0~b3~git2020041013.7bb6314e4-0ubuntu1

Source reference: /affected/2/versions

2:17.0.0-0ubuntu0.20.04.1

Source reference: /affected/2/versions

2:17.0.1-0ubuntu1

Source reference: /affected/2/versions

2:17.0.1-0ubuntu2

Source reference: /affected/2/versions

2:17.0.1-0ubuntu2+esm1

Source reference: /affected/2/versions

2:17.0.1-0ubuntu2+esm2

Source reference: /affected/2/versions

Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

keystone

Source reference: /affected/3/package/name

Affected versions
2:20.0.0-0ubuntu1

Source reference: /affected/3/versions

2:20.0.0+git2021120815.2ddf8f321-0ubuntu1

Source reference: /affected/3/versions

2:20.0.0+git2022011217.771c943ad-0ubuntu1

Source reference: /affected/3/versions

2:20.0.0+git2022030313.a3fc9e7c3-0ubuntu1

Source reference: /affected/3/versions

2:21.0.0-0ubuntu1

Source reference: /affected/3/versions

2:21.0.1-0ubuntu1

Source reference: /affected/3/versions

2:21.0.1-0ubuntu2

Source reference: /affected/3/versions

Fixed versions
2:21.0.1-0ubuntu2.1

Source reference: /affected/3/ranges

Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "keystone",
      "purl": "pkg:deb/ubuntu/keystone?arch=source&distro=esm-infra-legacy%2Fxenial",
      "ecosystem": "Ubuntu:Pro:16.04:LTS"
    },
    "versions": [
      "2:8.0.0-0ubuntu1",
      "2:9.0.0~b1-0ubuntu1",
      "2:9.0.0~b2-0ubuntu1",
      "2:9.0.0~b3-0ubuntu1",
      "2:9.0.0~rc1-0ubuntu1",
      "2:9.0.0-0ubuntu1",
      "2:9.0.2-0ubuntu1",
      "2:9.0.2-0ubuntu2",
      "2:9.1.0-0ubuntu1",
      "2:9.2.0-0ubuntu1",
      "2:9.3.0-0ubuntu1",
      "2:9.3.0-0ubuntu2",
      "2:9.3.0-0ubuntu3",
      "2:9.3.0-0ubuntu3.1",
      "2:9.3.0-0ubuntu3.2",
      "2:9.3.0-0ubuntu3.2+esm2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-3563.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "keystone",
          "binary_version": "2:9.3.0-0ubuntu3.2+esm2"
        },
        {
          "binary_name": "python-keystone",
          "binary_version": "2:9.3.0-0ubuntu3.2+esm2"
        }
      ],
      "priority_reason": "Upstream keystone developers have rated this to be a low severity issue"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "keystone",
      "purl": "pkg:deb/ubuntu/keystone?arch=source&distro=esm-infra%2Fbionic",
      "ecosystem": "Ubuntu:Pro:18.04:LTS"
    },
    "versions": [
      "2:12.0.0-0ubuntu1",
      "2:13.0.0~b1-0ubuntu1",
      "2:13.0.0~b2-0ubuntu1",
      "2:13.0.0~b3-0ubuntu1",
      "2:13.0.0~rc1-0ubuntu1",
      "2:13.0.0~rc2-0ubuntu1",
      "2:13.0.0-0ubuntu1",
      "2:13.0.1-0ubuntu1",
      "2:13.0.2-0ubuntu1",
      "2:13.0.2-0ubuntu3",
      "2:13.0.4-0ubuntu1",
      "2:13.0.4-0ubuntu1+esm1"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-3563.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "keystone",
          "binary_version": "2:13.0.4-0ubuntu1+esm1"
        },
        {
          "binary_name": "python-keystone",
          "binary_version": "2:13.0.4-0ubuntu1+esm1"
        }
      ],
      "priority_reason": "Upstream keystone developers have rated this to be a low severity issue"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          }
        ]
      }
    ],
    "package": {
      "name": "keystone",
      "purl": "pkg:deb/ubuntu/keystone?arch=source&distro=esm-infra%2Ffocal",
      "ecosystem": "Ubuntu:Pro:20.04:LTS"
    },
    "versions": [
      "2:16.0.0-0ubuntu1",
      "2:17.0.0~b1~git2019121613.db81fee63-0ubuntu1",
      "2:17.0.0~b2~git2020020513.99733f172-0ubuntu1",
      "2:17.0.0~b3~git2020032415.9f9040257-0ubuntu1",
      "2:17.0.0~b3~git2020032415.9f9040257-0ubuntu2",
      "2:17.0.0~b3~git2020041013.7bb6314e4-0ubuntu1",
      "2:17.0.0-0ubuntu0.20.04.1",
      "2:17.0.1-0ubuntu1",
      "2:17.0.1-0ubuntu2",
      "2:17.0.1-0ubuntu2+esm1",
      "2:17.0.1-0ubuntu2+esm2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-3563.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "keystone",
          "binary_version": "2:17.0.1-0ubuntu2+esm2"
        },
        {
          "binary_name": "keystone-common",
          "binary_version": "2:17.0.1-0ubuntu2+esm2"
        },
        {
          "binary_name": "python3-keystone",
          "binary_version": "2:17.0.1-0ubuntu2+esm2"
        }
      ],
      "priority_reason": "Upstream keystone developers have rated this to be a low severity issue"
    }
  },
  {
    "ranges": [
      {
        "type": "ECOSYSTEM",
        "events": [
          {
            "introduced": "0"
          },
          {
            "fixed": "2:21.0.1-0ubuntu2.1"
          }
        ]
      }
    ],
    "package": {
      "name": "keystone",
      "purl": "pkg:deb/ubuntu/keystone?arch=source&distro=jammy",
      "ecosystem": "Ubuntu:22.04:LTS"
    },
    "versions": [
      "2:20.0.0-0ubuntu1",
      "2:20.0.0+git2021120815.2ddf8f321-0ubuntu1",
      "2:20.0.0+git2022011217.771c943ad-0ubuntu1",
      "2:20.0.0+git2022030313.a3fc9e7c3-0ubuntu1",
      "2:21.0.0-0ubuntu1",
      "2:21.0.1-0ubuntu1",
      "2:21.0.1-0ubuntu2"
    ],
    "database_specific": {
      "source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-3563.json"
    },
    "ecosystem_specific": {
      "binaries": [
        {
          "binary_name": "keystone",
          "binary_version": "2:21.0.1-0ubuntu2.1"
        },
        {
          "binary_name": "keystone-common",
          "binary_version": "2:21.0.1-0ubuntu2.1"
        },
        {
          "binary_name": "python3-keystone",
          "binary_version": "2:21.0.1-0ubuntu2.1"
        }
      ],
      "availability": "No subscription required",
      "priority_reason": "Upstream keystone developers have rated this to be a low severity issue"
    }
  }
]

Publisher severity

No explicit severity was provided.

Event
#46225 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement