CVE-2014-0105

Published: Apr 15, 2014Modified: May 6, 2026

6.0

Vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability: 6.8 / Impact: 6.4

Source: NVD

Description

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

Affected (7)

Products: Openstack: Python Keystoneclient

Openstack

1 product

Python Keystoneclient

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Openstack Python Keystoneclient	Up to 0.4.2
Openstack Python Keystoneclient	Version 0.2.2
Openstack Python Keystoneclient	Version 0.2.3
Openstack Python Keystoneclient	Version 0.2.4
Openstack Python Keystoneclient	Version 0.3.0
Openstack Python Keystoneclient	Version 0.3.1
Openstack Python Keystoneclient	Version 0.3.2