Bug 1962908 (CVE-2021-3563) - CVE-2021-3563 Keystone: Verification of application credentials is silently length-limited
Summary: CVE-2021-3563 Keystone: Verification of application credentials is silently l...
Keywords:
Status: NEW
Alias: CVE-2021-3563
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Nobody
QA Contact:
URL:
Whiteboard:
Depends On: 1964525 1964527 1964529 2070962 2154112
Blocks: 1922882 1963091
TreeView+ depends on / blocked
 
Reported: 2021-05-20 18:41 UTC by Nick Tait
Modified: 2023-07-07 08:33 UTC (History)
16 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Nick Tait 2021-05-20 18:41:05 UTC 
Keystone only verifies part of the secret - the first 72 characters. Additional complexity is ignored, giving users an inflated sense of security. Default length of a secret seems to be 86 characters. While brute forcing at this scale is out of reach for many attackers, state of the art is constantly evolving and we need to support OpenStack for many years to come.
Comment 4 Jan Zerebecki 2021-06-09 13:43:11 UTC 
Upstream report is https://bugs.launchpad.net/keystone/+bug/1901891
Note You need to log in before you can comment on or make changes to this bug.