Skip to content
OpenAdvisories
Unscored USN-2406-1 1 CVE

keystone vulnerability

Published Nov 11, 2014 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Brant Knudson discovered that OpenStack Keystone did not properly perform
input sanitization when performing endpoint catalog substitution. A remote
attacker with privileged access for creating endpoints could exploit this
to obtain sensitive information.

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS keystone 1:2014.1.3-0ubuntu2.1

Vulnerabilities 1

  • Medium —
    CVE-2014-3621

    OpenStack Identity Keystone Exposure of Sensitive Information

    The catalog url replacement in OpenStack Identity (Keystone) before 2013.2.3 and 2014.1 before 2014.1.2.1 allows remote authenticated users to read sensitive configuration options via a crafted endpoint, as demonstrated by "$(admin_token)" in the publicurl en…

    keystone keystone keystone Debian Ubuntu PyPI

References

  • report
    https://ubuntu.com/security/CVE-2014-3621