CVE-2013-2013: python-keystoneclient unsecure user… – CVSS 2.1 · Watchpost

← All vulnerabilities

python-keystoneclient unsecure user password update

FAIBLE 2.1CVE-2013-2013 · GHSA-8q2m-pwxf-jc7g · PYSEC-2013-24 · Published 01/10/2013 · updated 16/06/2026

En bref

CVE-2013-2013 est une vulnérabilité FAIBLE (CVSS 2.1) touchant python-keystoneclient, python-keystoneclient (openstack).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.37%, plus élevée que 31.3% des vulnérabilités.
Correctif : mettre à jour vers 0.2.4 ou plus récent.

Package	Affected versions	Patched versions
python-keystoneclient PyPI	`< 0.2.4`	`0.2.4`
python-keystoneclient openstack	`= 0.2.2≤ 0.2.3`	No fix yet

Description

The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process.

NVD description

The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process.

References

nvd.nist.gov/vuln/detail/CVE-2013-2013 · ADVISORY
openstack/python-keystoneclient commit f2e0818 · WEB
bugs.launchpad.net/python-keystoneclient/+bug/938315 · WEB
openstack/python-keystoneclient · PACKAGE
pypa/advisory-database · WEB
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16937 · WEB
openwall.com/lists/oss-security/2013/05/23/4 · WEB
GitHub Advisory GHSA-8q2m-pwxf-jc7g · ADVISORY

Autres vulnérabilités de python-keystoneclient

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free