| Package | Affected versions | Patched versions |
|---|---|---|
| keystone | < 14.1.0 | 14.1.0 |
| keystone | ≤ 14.0.1 |
** DISPUTED ** OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free