CVE-2013-2166 Inadequate Encryption Strength in python-keystoneclient
An attacker can bypass memcache encryption in the Python Keystone client, potentially exposing sensitive authentication data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-2166?
CVE-2013-2166 is a critical vulnerability in Debian Debian Linux, published on 10 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass
Weakness: CWE-326
Which versions are affected by CVE-2013-2166?
3 open source packages ship an affected version, including python-keystoneclient. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
python-keystoneclient PyPI | From 0.2.3 | 0.3.0 |
python-keystoneclient PyPI | From 0.2.3 | 0.3.0 |
python-keystoneclient PyPI | From 0.2.3 | 0.3.0 |
Products include Debian Debian Linux, Fedoraproject Fedora, Openstack Python-Keystoneclient, Redhat Openstack.
How do I fix CVE-2013-2166?
Upgrade python-keystoneclient to 0.3.0 or later.
Is CVE-2013-2166 being exploited?
There is no known exploitation of CVE-2013-2166 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2013-2166, GHSA-c3xq-cj8f-7829, PYSEC-2019-197.