[SECURITY] [DLA 3714-1] keystone security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3714-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Bastien Roucariès
January 21, 2024 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : keystone
Version : 2:14.2.0-0+deb10u2
CVE ID : CVE-2021-3563 CVE-2021-38155
Debian Bug : 992070 989998
Brief introduction
CVE-2021-3563
A flaw was found in openstack-keystone. Only the first 72 characters
of an application secret are verified allowing attackers bypass some
password complexity which administrators may be counting on.
The highest threat from this vulnerability is to data confidentiality
and integrity.
CVE-2021-38155
Keystone allowed information disclosure during account locking
(related to PCI DSS features). By guessing the name of an account
and failing to authenticate multiple times, any unauthenticated actor
could both confirm the account exists and obtain that account's
corresponding UUID, which might be leveraged for other unrelated
attacks. All deployments enabling
security_compliance.lockout_failure_attempts are affected.
For Debian 10 buster, these problems have been fixed in version
2:14.2.0-0+deb10u2.
We recommend that you upgrade your keystone packages.
For the detailed security status of keystone please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/keystone
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmWtkIkACgkQADoaLapB
CF9ZkxAAtXIEz8di0uCKh4Tm9AdvdDtk+wcxOatJZIIr8HjlKodmniVWN3BHoUId
UBD81YvBLELzaz+VDwd4PsGOW6ZAMEZbWJiO5z7Sz0emHQ04a4bqp8rhCyL8nwis
dYg18sh1XSEyU/Yz//oFZENc+6A3yndi7iNXOo3xWg3mVc82K17KyjqD6ViFdsHV
90EUJ6QFeyidABA7sTsJjXDjhu8jeGlX3gXECpT1b/uvNNAcbfLNydVj7v4MzPxQ
qZ2QSA+7IqB2H+rOoP9RcjSMcnxZoQkglhX3OR2AewWixTMWY9dXABV5X7unf98o
zbL0nDnyXlUkFdPknvhl52ghAQZg3kca/497jTnUsmv/ru6LH4JsVjam2xOOZiul
Yl2+tiO7MJb6T/8pRRwvcSqbKrwyhzqPsoM6FM+MZ/I6Up4geltnCPbNF8x13LLR
Ol9kqEuCRXErW8urqwm5qzgSLWhlG5WBcWXCDe9SxSnMhRTI5wNpIYWgNcvfe14G
nb7puiJCbBtfeoq6bSnPtnjDlHu1fGiJdC8fS/FOsFMHy5TwJ8QT2mViDf/vLLXO
ZTLV1Q3CaaX9MitC/tUDniSlQ3m44u5eCFVUIqrULuuo+ehBRHGGgzNMbIWRc8Rr
pcx8X2HExpQ0hhxeDavNuRq43A2YXDczgf69+HADkKlOdqw+hjo=
=22eM
-----END PGP SIGNATURE-----
Reply to: