CVE-2013-2167 Insufficient Verification of Data Authenticity in python-keystoneclient
Attackers can bypass memcache signing in python-keystoneclient, potentially compromising authentication integrity in OpenStack environments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-2167?
CVE-2013-2167 is a critical vulnerability in Debian Debian Linux, published on 10 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass
Weakness: CWE-345
Which versions are affected by CVE-2013-2167?
3 open source packages ship an affected version, including python-keystoneclient. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
python-keystoneclient PyPI | From 0.2.3 | 0.3.0 |
python-keystoneclient PyPI | From 0.2.3 | 0.3.0 |
python-keystoneclient PyPI | From 0.2.3 | 0.3.0 |
Products include Debian Debian Linux, Openstack Python-Keystoneclient, Redhat Openstack.
How do I fix CVE-2013-2167?
Upgrade python-keystoneclient to 0.3.0 or later.
Is CVE-2013-2167 being exploited?
There is no known exploitation of CVE-2013-2167 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2013-2167, GHSA-9vg3-cf92-h2h7, PYSEC-2019-161.