CVE-2021-3563 Openstack Keystone Incorrect Authorization vulnerability
Attackers can bypass password complexity checks in OpenStack Keystone by exploiting truncated secret verification, compromising data confidentiality and integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-3563?
CVE-2021-3563 is a high-severity vulnerability in Debian Debian Linux, published on 26 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.
Weakness: CWE-863
Which versions are affected by CVE-2021-3563?
3 open source packages ship an affected version, including keystone. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
keystone PyPI | All versions to 21.0.0 | None |
keystone PyPI | All versions to 21.0.0 | None |
keystone PyPI | All versions to 21.0.0 | None |
Products include Debian Debian Linux, Openstack Keystone, Redhat Openstack Platform.
How do I fix CVE-2021-3563?
Apply the vendor's patch.
Is CVE-2021-3563 being exploited?
There is no known exploitation of CVE-2021-3563 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2021-3563, GHSA-cc99-whm5-mmq3, PYSEC-2026-370, UBUNTU-CVE-2021-3563.