Every CVESearch/Get API key

CVE-2014-0105

python-keystoneclient vulnerable to context confusion in Keystone auth_token middleware

6.0 MediumFix available

CVE-2014-0105 is a medium vulnerability (CVSS 6.0) in Openstack Python-keystoneclient, published April 15, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.09%, the 65th percentile. Fixed in python-keystoneclient 0.7.0.

What does this mean?
Severity
6.0 MediumCVSS 2.0, NVD
Exploit chance
1.09%EPSS, 65th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
0.7.0python-keystoneclient +15 more

Description

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

Exploit likelihood

1.09%Unchanged since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
python-keystoneclient
PyPI
through 0.6.0
0.7.0
keystone
Debian:12
before 2013.1.1-2
2013.1.1-2
keystone
Debian:13
before 2013.1.1-2
2013.1.1-2
keystone
Debian:14
before 2013.1.1-2
2013.1.1-2
python-keystoneclient
Debian:12
before 1:0.6.0-4
1:0.6.0-4
python-keystoneclient
Debian:13
before 1:0.6.0-4
1:0.6.0-4
python-keystoneclient
Debian:14
before 1:0.6.0-4
1:0.6.0-4
python-keystoneclient
PyPI
before 0.7.0, plus listed versions
0.1.10.1.20.1.30.2.00.2.1
Show 13 moreShow less
0.2.20.2.30.2.40.2.50.3.00.3.10.3.20.4.00.4.10.4.20.5.00.5.10.6.0
0.7.0
python-keystoneclient
Red Hat:openstack:4::el6
before 1:0.7.1-2.el6ost
1:0.7.1-2.el6ost
python-keystoneclient-doc
Red Hat:openstack:4::el6
before 1:0.7.1-2.el6ost
1:0.7.1-2.el6ost
Show 6 moreShow less
Affected packages
PackageAffectedFixed
python-six
Red Hat:openstack:4::el6
before 0:1.5.2-1.el6
0:1.5.2-1.el6
python-keystoneclient
Red Hat:storage:2.1:server:el6
before 1:0.7.1-2.el6ost
1:0.7.1-2.el6ost
python-keystoneclient-doc
Red Hat:storage:2.1:server:el6
before 1:0.7.1-2.el6ost
1:0.7.1-2.el6ost
python-six
Red Hat:storage:2.1:server:el6
before 0:1.5.2-1.el6
0:1.5.2-1.el6
python-keystoneclient
Red Hat:openstack:3::el6
before 1:0.2.3-8.el6ost
1:0.2.3-8.el6ost
python-keystoneclient-doc
Red Hat:openstack:3::el6
before 1:0.2.3-8.el6ost
1:0.2.3-8.el6ost

What each source reports

NVD Score used6.0

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

Record
CVE-2014-0105
CVSS 2.0
6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Weakness
CWE-255
Updated
2026-11-02
CVE ListNo score

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

Record
CVE-2014-0105
Updated
2026-11-02
EUVDEUVD-2014-0092No score

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

Record
EUVD-2014-0092
Updated
2026-11-03
GitHub AdvisoriesGHSA-gwvq-rgqf-993f2.3

python-keystoneclient vulnerable to context confusion in Keystone auth_token middleware

A context confusion vulnerability was identified in Keystone auth_token middleware (shipped in python-keystoneclient) before 0.7.0. By doing repeated requests, with sufficient load on the target system, an authenticated user may in certain situations assume another authenticated user's complete identity and multi-tenant authorizations, potentially resulting in a privilege escalation. Note that it is related to a bad interaction between eventlet and python-memcached that should be avoided if the calling process already monkey-patches "thread" to use eventlet. Only keystone middleware setups using auth_token with memcache are vulnerable.

Record
GHSA-gwvq-rgqf-993f
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
CVSS 3.1
6.0 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-522
Updated
2026-11-02
OSVGHSA-gwvq-rgqf-993f2.3

python-keystoneclient vulnerable to context confusion in Keystone auth_token middleware

A context confusion vulnerability was identified in Keystone auth_token middleware (shipped in python-keystoneclient) before 0.7.0. By doing repeated requests, with sufficient load on the target system, an authenticated user may in certain situations assume another authenticated user's complete identity and multi-tenant authorizations, potentially resulting in a privilege escalation. Note that it is related to a bad interaction between eventlet and python-memcached that should be avoided if the calling process already monkey-patches "thread" to use eventlet. Only keystone middleware setups using auth_token with memcache are vulnerable.

Record
GHSA-gwvq-rgqf-993f
CVSS 4.0
2.3 LowCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:L
CVSS 3.1
6.0 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-522
Updated
2026-11-02
OSVNo score

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

Record
CVE-2014-0105
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2014-0105No score

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

Record
DEBIAN-CVE-2014-0105
Updated
2026-11-02
OSVopenSUSE-SU-2024:10471-1No score

python-keystoneclient-3.5.0-1.1 on GA media

These are all security issues fixed in the python-keystoneclient-3.5.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10471-1
Updated
2026-11-02
OSVPYSEC-2014-70No score

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

Record
PYSEC-2014-70
Updated
2026-11-02
OSVUBUNTU-CVE-2014-0105No score

The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly retrieve user tokens from memcache, which allows remote authenticated users to gain privileges in opportunistic circumstances via a large number of requests, related to an "interaction between eventlet and python-memcached."

Record
UBUNTU-CVE-2014-0105
Updated
2026-11-02

History

History
RecordedChangedSources
facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 18 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open