Skip to content
OpenAdvisories
Unscored RHSA-2013:0596 3 CVEs

Red Hat Security Advisory: openstack-keystone security, bug fix, and enhancement update

Published Sep 15, 2024 · Updated Aug 8, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · OpenStack 2 openstack:2::el6 openstack-keystone 0:2012.2.3-3.el6ost
Red Hat · OpenStack 2 openstack:2::el6 openstack-keystone-doc 0:2012.2.3-3.el6ost
Red Hat · OpenStack 2 openstack:2::el6 python-keystone 0:2012.2.3-3.el6ost

Vulnerabilities 3

  • Medium —
    CVE-2013-0282

    OpenStack Keystone allows context-dependent attackers to bypass access restrictions

    OpenStack Keystone Grizzly before 2013.1, Folsom 2012.1.3 and earlier, and Essex does not properly check if the (1) user, (2) tenant, or (3) domain is enabled when using EC2-style authentication, which allows context-dependent attackers to bypass access restr…

    keystone keystone Debian PyPI
  • Medium —
    CVE-2013-1664

    XML Entity Expansion (XEE) in Django

    The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (r…

    django nova keystone cinder Debian PyPI
  • Medium —
    CVE-2013-1665

    XML External Entity (XXE) in Django

    The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an ent…

    python-django django keystone Debian PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=908995
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=910928
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=912982
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=913808
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0596.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-0282
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-0282
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-0282
  • article
    http://lists.openstack.org/pipermail/openstack-announce/2013-February/000079.html
  • report
    https://access.redhat.com/security/cve/CVE-2013-1664
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-1664
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-1664
  • report
    https://access.redhat.com/security/cve/CVE-2013-1665
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-1665
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-1665