id: PYSEC-2018-9
details: '** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration
  vulnerability because invalid usernames have much faster responses than valid ones
  for a POST /v3/auth/tokens request. NOTE: the vendor''s position is that this is
  a hardening opportunity, and not necessarily an issue that should have an OpenStack
  Security Advisory.'
affected:
- package:
    name: keystone
    ecosystem: PyPI
    purl: pkg:pypi/keystone
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 14.1.0
  versions:
  - 12.0.2
  - 12.0.3
  - 13.0.2
  - 13.0.3
  - 13.0.4
  - 14.0.0
  - 14.0.1
references:
- type: WEB
  url: https://bugs.launchpad.net/keystone/+bug/1795800
aliases:
- CVE-2018-20170
modified: "2021-06-10T06:51:56.696140Z"
published: "2018-12-17T07:29:00Z"