Debian alert DLA-3714-1 (keystone)

From:
             
 
rouca@debian.org
To:
             
 
<debian-lts-announce@lists.debian.org>
Subject:
             
 
[SECURITY] [DLA 3714-1] keystone security update
Date:
             
 
Sun, 21 Jan 2024 21:45:45 +0000
Message-ID:
             
 
<5e10ed113ab5ffa1ba2db83512d48e35.rouca@debian.org>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-3714-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                   Bastien Roucariès
January 21, 2024                              https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : keystone
Version        : 2:14.2.0-0+deb10u2
CVE ID         : CVE-2021-3563 CVE-2021-38155
Debian Bug     : 992070 989998

Brief introduction 

CVE-2021-3563

    A flaw was found in openstack-keystone. Only the first 72 characters
    of an application secret are verified allowing attackers bypass some
    password complexity which administrators may be counting on.
    The highest threat from this vulnerability is to data confidentiality
    and integrity.

CVE-2021-38155

    Keystone allowed information disclosure during account locking
    (related to PCI DSS features). By guessing the name of an account
    and failing to authenticate multiple times, any unauthenticated actor
    could both confirm the account exists and obtain that account's
    corresponding UUID, which might be leveraged for other unrelated
    attacks. All deployments enabling
    security_compliance.lockout_failure_attempts are affected.

For Debian 10 buster, these problems have been fixed in version
2:14.2.0-0+deb10u2.

We recommend that you upgrade your keystone packages.

For the detailed security status of keystone please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/keystone

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmWtkIkACgkQADoaLapB
CF9ZkxAAtXIEz8di0uCKh4Tm9AdvdDtk+wcxOatJZIIr8HjlKodmniVWN3BHoUId
UBD81YvBLELzaz+VDwd4PsGOW6ZAMEZbWJiO5z7Sz0emHQ04a4bqp8rhCyL8nwis
dYg18sh1XSEyU/Yz//oFZENc+6A3yndi7iNXOo3xWg3mVc82K17KyjqD6ViFdsHV
90EUJ6QFeyidABA7sTsJjXDjhu8jeGlX3gXECpT1b/uvNNAcbfLNydVj7v4MzPxQ
qZ2QSA+7IqB2H+rOoP9RcjSMcnxZoQkglhX3OR2AewWixTMWY9dXABV5X7unf98o
zbL0nDnyXlUkFdPknvhl52ghAQZg3kca/497jTnUsmv/ru6LH4JsVjam2xOOZiul
Yl2+tiO7MJb6T/8pRRwvcSqbKrwyhzqPsoM6FM+MZ/I6Up4geltnCPbNF8x13LLR
Ol9kqEuCRXErW8urqwm5qzgSLWhlG5WBcWXCDe9SxSnMhRTI5wNpIYWgNcvfe14G
nb7puiJCbBtfeoq6bSnPtnjDlHu1fGiJdC8fS/FOsFMHy5TwJ8QT2mViDf/vLLXO
ZTLV1Q3CaaX9MitC/tUDniSlQ3m44u5eCFVUIqrULuuo+ehBRHGGgzNMbIWRc8Rr
pcx8X2HExpQ0hhxeDavNuRq43A2YXDczgf69+HADkKlOdqw+hjo=
=22eM
-----END PGP SIGNATURE-----