CVE-2013-2157 OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
MediumCVSS 4.3
EPSS 3.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
OpenStack Keystone Folsom, Grizzly before 2013.1.3, and Havana, when using LDAP with Anonymous binding, allows remote attackers to bypass authentication via an empty password.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/keystone(Debian:12) | < 2013.1.2-1 | 2013.1.2-1 |
| debian/keystone(Debian:13) | < 2013.1.2-1 | 2013.1.2-1 |
| debian/keystone(Debian:14) | < 2013.1.2-1 | 2013.1.2-1 |
| OpenStack Keystone | >= 2012.2, <= 2012.2.4 | No fix listed |
| OpenStack Keystone | >= 2013.1, < 2013.1.3 | 2013.1.3 |
| OpenStack Keystone | >= 2013.2, <= 2013.2.4 | No fix listed |
References
- Debian Security Tracker CVE-2013-2157 vendor-advisory
- RHSA-2013:0994 third-party-advisory vendor-advisory
- RHSA-2013:1083 third-party-advisory vendor-advisory
- [oss-security] 20130613 [OSSA 2013-015] Authentication bypass when using LDAP backend (CVE-2013-2157) mailing-list third-party-advisory
- 60545 third-party-advisory vdb-entry
- bugs.debian.org issue-tracking