{"id":"CVE-2018-20170","aliases":["EUVD-2018-0082","GHSA-jpv2-hwjh-97c7","PYSEC-2018-9","UBUNTU-CVE-2018-20170"],"status":"disputed","title":"** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because...","description":"OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0112,"percentile":0.66388,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2018-12-17T06:00:00Z","modified":"2026-10-24T10:30:59Z","fixes":[{"ecosystem":"PyPI","package":"keystone","fixed_in":["14.1.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"PyPI","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.1.0"}]}],"versions":["12.0.2","12.0.3","13.0.2","13.0.3","13.0.4","14.0.0","14.0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:8.0.0-0ubuntu1","2:9.0.0~b1-0ubuntu1","2:9.0.0~b2-0ubuntu1","2:9.0.0~b3-0ubuntu1","2:9.0.0~rc1-0ubuntu1","2:9.0.0-0ubuntu1","2:9.0.2-0ubuntu1","2:9.0.2-0ubuntu2","2:9.1.0-0ubuntu1","2:9.2.0-0ubuntu1","2:9.3.0-0ubuntu1","2:9.3.0-0ubuntu2","2:9.3.0-0ubuntu3","2:9.3.0-0ubuntu3.1","2:9.3.0-0ubuntu3.2","2:9.3.0-0ubuntu3.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"keystone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:12.0.0-0ubuntu1","2:13.0.0~b1-0ubuntu1","2:13.0.0~b2-0ubuntu1","2:13.0.0~b3-0ubuntu1","2:13.0.0~rc1-0ubuntu1","2:13.0.0~rc2-0ubuntu1","2:13.0.0-0ubuntu1","2:13.0.1-0ubuntu1","2:13.0.2-0ubuntu1","2:13.0.2-0ubuntu3","2:13.0.4-0ubuntu1","2:13.0.4-0ubuntu1+esm1"]}],"products":[{"vendor":"openstack","product":"keystone"}],"references":[{"url":"https://bugs.launchpad.net/keystone/+bug/1795800","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20170"},{"url":"https://github.com/advisories/GHSA-jpv2-hwjh-97c7"},{"url":"https://ubuntu.com/security/CVE-2018-20170","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20170","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2018-20170","description":"OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory","status":"disputed","published":"2018-12-17T06:00:00Z","modified":"2024-11-14T20:09:49.052Z","updated_at":"2026-11-02T14:35:00.237825Z"}],"euvd":[{"id":"EUVD-2018-0082","description":"OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory","status":"published","published":"2018-12-17T06:00:00Z","modified":"2024-11-14T20:09:49Z","updated_at":"2026-11-03T00:04:59.953537Z"}],"ghsa":[{"id":"GHSA-jpv2-hwjh-97c7","title":"** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because...","description":"** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory.","status":"published","published":"2022-05-14T01:36:15Z","modified":"2023-02-02T05:04:11Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:51:48.450626Z"}],"nvd":[{"id":"CVE-2018-20170","description":"OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory","status":"disputed","published":"2018-12-17T07:29:00.747Z","modified":"2026-06-17T01:52:23.423Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:04:50.99633Z"}],"osv":[{"id":"CVE-2018-20170","description":"OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory","status":"published","published":"2018-12-17T07:29:00.747Z","modified":"2026-10-24T10:30:59.086025289Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"UBUNTU-CVE-2018-20170","description":"OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory","status":"published","published":"2018-12-17T07:29:00Z","modified":"2026-09-30T18:20:32.053479856Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:17.91743Z"},{"id":"PYSEC-2018-9","description":"** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory.","status":"published","published":"2018-12-17T07:29:00Z","modified":"2023-11-08T04:00:11.214462Z","updated_at":"2026-11-02T15:52:52.192131Z"}]}}