python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass (CVE-2013-2167)

Selective backports from stable/grizzly :

  - Ec2Signer: Initial support for v4 signature     verification.

    - Allow signature verification for older boto versions.

    - Default signing_dir to secure temp dir.

    - Fix memcache encryption middleware. (CVE-2013-2166,       CVE-2013-2167)

    - Check token expiry. (CVE-2013-2104)

    - Allow secure user password update. (CVE-2013-2013)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
422956	SCA: security update for python-keystoneclient (GHSA-9vg3-cf92-h2h7)	Tenable Cloud Security	SCA Checks	critical
422956	SCA: security update for python-keystoneclient (GHSA-9vg3-cf92-h2h7)	Tenable Self-Hosted Container Security	SCA Checks	critical
69361	Fedora 19 : python-keystoneclient-0.2.3-7.fc19 (2013-14302)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-2167

critical

Tenable Plugins

critical

critical

medium