Every CVE Search/ Get API key

CVE-2014-0105

python-keystoneclient vulnerable to context confusion in Keystone auth_token middleware

6.0 MediumFix available

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

Exploit likelihood

1.10%Unchanged since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.0

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

Record
CVE-2014-0105
CVSS 2.0
6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Weakness
CWE-255
Updated
2026-11-02
CVE List No score

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

Record
CVE-2014-0105
Updated
2026-11-02
EUVDEUVD-2014-0092 No score

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

Record
EUVD-2014-0092
Updated
2026-11-03
GitHub AdvisoriesGHSA-gwvq-rgqf-993f 2.3

python-keystoneclient vulnerable to context confusion in Keystone auth_token middleware

A context confusion vulnerability was identified in Keystone auth_token middleware (shipped in python-keystoneclient) before 0.7.0. By doing repeated requests, with sufficient load on the target system, an authenticated user may in certain situations assume another authenticated user's complete identity and multi-tenant authorizations, potentially resulting in a privilege escalation. Note that it is related to a bad interaction between eventlet and python-memcached that should be avoided if the calling process already monkey-patches "thread" to use eventlet. Only keystone middleware setups using auth_token with memcache are vulnerable.

Record
GHSA-gwvq-rgqf-993f
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
CVSS 3.1
6.0 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-522
Updated
2026-11-02
OSVGHSA-gwvq-rgqf-993f 2.3

python-keystoneclient vulnerable to context confusion in Keystone auth_token middleware

A context confusion vulnerability was identified in Keystone auth_token middleware (shipped in python-keystoneclient) before 0.7.0. By doing repeated requests, with sufficient load on the target system, an authenticated user may in certain situations assume another authenticated user's complete identity and multi-tenant authorizations, potentially resulting in a privilege escalation. Note that it is related to a bad interaction between eventlet and python-memcached that should be avoided if the calling process already monkey-patches "thread" to use eventlet. Only keystone middleware setups using auth_token with memcache are vulnerable.

Record
GHSA-gwvq-rgqf-993f
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
CVSS 3.1
6.0 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-522
Updated
2026-11-02
OSV No score

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

Record
CVE-2014-0105
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2014-0105 No score

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

Record
DEBIAN-CVE-2014-0105
Updated
2026-11-02
OSVopenSUSE-SU-2024:10471-1 No score

python-keystoneclient-3.5.0-1.1 on GA media

These are all security issues fixed in the python-keystoneclient-3.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10471-1
Updated
2026-11-02
OSVPYSEC-2014-70 No score

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

Record
PYSEC-2014-70
Updated
2026-11-02
OSVUBUNTU-CVE-2014-0105 No score

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

Record
UBUNTU-CVE-2014-0105
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
python-keystoneclient
PyPI
 through 0.6.0
0.7.0
keystone
Debian:12
 before 2013.1.1-2
2013.1.1-2
keystone
Debian:13
 before 2013.1.1-2
2013.1.1-2
keystone
Debian:14
 before 2013.1.1-2
2013.1.1-2
python-keystoneclient
Debian:12
 before 1:0.6.0-4
1:0.6.0-4
python-keystoneclient
Debian:13
 before 1:0.6.0-4
1:0.6.0-4
python-keystoneclient
Debian:14
 before 1:0.6.0-4
1:0.6.0-4
python-keystoneclient
PyPI
 before 0.7.0, plus listed versions
0.1.10.1.20.1.30.2.00.2.1
Show 13 moreShow less
0.2.20.2.30.2.40.2.50.3.00.3.10.3.20.4.00.4.10.4.20.5.00.5.10.6.0
0.7.0
python-keystoneclient
Red Hat:openstack:4::el6
 before 1:0.7.1-2.el6ost
1:0.7.1-2.el6ost
python-keystoneclient-doc
Red Hat:openstack:4::el6
 before 1:0.7.1-2.el6ost
1:0.7.1-2.el6ost
Show 6 moreShow less
Affected packages
PackageAffectedFixed
python-six
Red Hat:openstack:4::el6
 before 0:1.5.2-1.el6
0:1.5.2-1.el6
python-keystoneclient
Red Hat:storage:2.1:server:el6
 before 1:0.7.1-2.el6ost
1:0.7.1-2.el6ost
python-keystoneclient-doc
Red Hat:storage:2.1:server:el6
 before 1:0.7.1-2.el6ost
1:0.7.1-2.el6ost
python-six
Red Hat:storage:2.1:server:el6
 before 0:1.5.2-1.el6
0:1.5.2-1.el6
python-keystoneclient
Red Hat:openstack:3::el6
 before 1:0.2.3-8.el6ost
1:0.2.3-8.el6ost
python-keystoneclient-doc
Red Hat:openstack:3::el6
 before 1:0.2.3-8.el6ost
1:0.2.3-8.el6ost

History

History
RecordedChangedSources
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0105 is a medium vulnerability (CVSS 6.0) in Openstack Python-keystoneclient, published April 15, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.10%, the 65th percentile. Fixed in python-keystoneclient 0.7.0.

References

Show 18 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open