NVD

Id
29039  
Name
CVE-2014-0105  
Description
The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."  
Reject
 
CVSS Version
2  
CVSS Score
6  
Severity
Medium  
CVSS Base Score
6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2014-04-15  
Modified Date
2014-04-16  
Seq
2014-0105  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
153331 29039 CVE-2014-0105 RHSA-2014:0382  View
153332 29039 CVE-2014-0105 [oss-security] 20140327 [OSSA 2014-007] Potential context confusion in Keystone middleware (CVE-2014-0105)  View
153333 29039 CVE-2014-0105 https://bugs.launchpad.net/python-keystoneclient/+bug/1282865  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
13252 JVNDB-2014-002127 Keystone 用 OpenStack Python クライアントライブラリの auth_token ミドルウェアにおける権限を取得される脆弱性 Keystone 用 OpenStack Python クライアントライブラリの auth_token ミドルウェアは、メモリキャッシュからユーザのトークンを適切に取得しないため、権限を取得される脆弱性が存在します。 CVE-2014-0105 67506 CVE-2014-0105 29039 6 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002127.html 2014-03-26 2014-04-18 View