OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that accounts corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.
The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Keystone | Openstack | 10.0.0 (including) | 16.0.2 (excluding) |
| Keystone | Openstack | 17.0.0 (including) | 17.0.1 (excluding) |
| Keystone | Openstack | 18.0.0 (including) | 18.0.1 (excluding) |
| Keystone | Openstack | 19.0.0 (including) | 19.0.1 (excluding) |
| Keystone | Ubuntu | bionic | * |
| Keystone | Ubuntu | hirsute | * |
| Keystone | Ubuntu | impish | * |
| Keystone | Ubuntu | kinetic | * |
| Keystone | Ubuntu | lunar | * |
| Keystone | Ubuntu | mantic | * |
| Keystone | Ubuntu | trusty | * |
| Keystone | Ubuntu | xenial | * |
Common protection mechanisms include:
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
Consider using libraries with authentication capabilities such as OpenSSL or the ESAPI Authenticator. [REF-45]