CVE catalog
CVE-2018-20170
UBUNTU-CVE-2018-20170
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 1.12% · Oct 25, 2026
OpenStack Keystone through 14.0.1 has a user enumeration vulnerability because invalid usernames have much faster responses than valid ones for a POST /v3/auth/tokens request. NOTE: the vendor's position is that this is a hardening opportunity, and not necessarily an issue that should have an OpenStack Security Advisory
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | keystone | pro | 2:8.0.0-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:9.0.0~b1-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:9.0.0~b2-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:9.0.0~b3-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:9.0.0~rc1-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:9.0.0-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:9.0.2-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:9.0.2-0ubuntu2 | vulnerable |
| Ubuntu | keystone | pro | 2:9.1.0-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:9.2.0-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:9.3.0-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:9.3.0-0ubuntu2 | vulnerable |
| Ubuntu | keystone | pro | 2:9.3.0-0ubuntu3 | vulnerable |
| Ubuntu | keystone | pro | 2:9.3.0-0ubuntu3.1 | vulnerable |
| Ubuntu | keystone | pro | 2:9.3.0-0ubuntu3.2 | vulnerable |
| Ubuntu | keystone | pro | 2:9.3.0-0ubuntu3.2+esm2 | vulnerable |
| Ubuntu | keystone | pro | 2:12.0.0-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:13.0.0~b1-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:13.0.0~b2-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:13.0.0~b3-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:13.0.0~rc1-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:13.0.0~rc2-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:13.0.0-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:13.0.1-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:13.0.2-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:13.0.2-0ubuntu3 | vulnerable |
| Ubuntu | keystone | pro | 2:13.0.4-0ubuntu1 | vulnerable |
| Ubuntu | keystone | pro | 2:13.0.4-0ubuntu1+esm1 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
Observed: