CVE catalog

CVE-2021-3563

keystone affected and fixed versions

A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.

Severity: High · CVSS 7.4CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Published: Feb 17, 2021, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.86% · Oct 27, 2026

Projects and upstream resources

[keystone][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie-security	keystone	`2:27.0.0-3+deb13u6`	Fixed	[CVE-2021-3563]
Debiantrixie	keystone	`2:23.0.0-3`	FixedDistribution-reported fixed boundary	[CVE-2021-3563]
Debiantrixie	keystone	`2:27.0.0-3+deb13u5`	Fixed	[CVE-2021-3563]
Debiansid	keystone	`2:23.0.0-3`	FixedDistribution-reported fixed boundary	[CVE-2021-3563]
Debiansid	keystone	`2:30.0.0-3`	Fixed	[CVE-2021-3563]
Debianforky	keystone	`2:23.0.0-3`	FixedDistribution-reported fixed boundary	[CVE-2021-3563]
Debianforky	keystone	`2:30.0.0-3`	Fixed	[CVE-2021-3563]

Showing 7 fix observations. All 30 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	keystone	Not reported	UnknownSource applicability is not established	Provider not reported
Debianbookworm	keystone	Not reported	AffectedDistribution reports no fix	[CVE-2021-3563]
Debianbookworm	keystone	`2:22.0.2-0+deb12u3`	Affected	[CVE-2021-3563]
Debianbookworm-security	keystone	`2:22.0.2-0+deb12u6`	Affected	[CVE-2021-3563]
Debianforky	keystone	`2:23.0.0-3`	FixedDistribution-reported fixed boundary	[CVE-2021-3563]
Debianforky	keystone	`2:30.0.0-3`	Fixed	[CVE-2021-3563]
Debiansid	keystone	`2:23.0.0-3`	FixedDistribution-reported fixed boundary	[CVE-2021-3563]
Debiansid	keystone	`2:30.0.0-3`	Fixed	[CVE-2021-3563]
Debiantrixie	keystone	`2:23.0.0-3`	FixedDistribution-reported fixed boundary	[CVE-2021-3563]
Debiantrixie	keystone	`2:27.0.0-3+deb13u5`	Fixed	[CVE-2021-3563]
Debiantrixie-security	keystone	`2:27.0.0-3+deb13u6`	Fixed	[CVE-2021-3563]
Ubuntu22.04	keystone	`2:20.0.0+git2021120815.2ddf8f321-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC[USN-7926-1]Apr 27, 2026, 6:31:24 PM UTC
Ubuntu22.04	keystone	`2:20.0.0+git2022011217.771c943ad-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC[USN-7926-1]Apr 27, 2026, 6:31:24 PM UTC
Ubuntu22.04	keystone	`2:20.0.0+git2022030313.a3fc9e7c3-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC[USN-7926-1]Apr 27, 2026, 6:31:24 PM UTC
Ubuntu22.04	keystone	`2:20.0.0-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC[USN-7926-1]Apr 27, 2026, 6:31:24 PM UTC
Ubuntu22.04	keystone	`2:21.0.0-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC[USN-7926-1]Apr 27, 2026, 6:31:24 PM UTC
Ubuntu22.04	keystone	`2:21.0.1-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC[USN-7926-1]Apr 27, 2026, 6:31:24 PM UTC
Ubuntu22.04	keystone	`2:21.0.1-0ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC[USN-7926-1]Apr 27, 2026, 6:31:24 PM UTC
Ubuntu22.04	keystone	`2:21.0.1-0ubuntu2.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC[USN-7926-1]Apr 27, 2026, 6:31:24 PM UTC
Ubuntupro	keystone	`2:16.0.0-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC
Ubuntupro	keystone	`2:17.0.0-0ubuntu0.20.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC
Ubuntupro	keystone	`2:17.0.0~b1~git2019121613.db81fee63-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC
Ubuntupro	keystone	`2:17.0.0~b2~git2020020513.99733f172-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC
Ubuntupro	keystone	`2:17.0.0~b3~git2020032415.9f9040257-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC
Ubuntupro	keystone	`2:17.0.0~b3~git2020032415.9f9040257-0ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC
Ubuntupro	keystone	`2:17.0.0~b3~git2020041013.7bb6314e4-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC
Ubuntupro	keystone	`2:17.0.1-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC
Ubuntupro	keystone	`2:17.0.1-0ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC
Ubuntupro	keystone	`2:17.0.1-0ubuntu2+esm1`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC
Ubuntupro	keystone	`2:17.0.1-0ubuntu2+esm2`	UnknownSource applicability is not established	[UBUNTU-CVE-2021-3563]Sep 30, 2026, 6:21:23 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "keystone",
      "status": "fixed",
      "release": "sid",
      "version": "2:30.0.0-3"
    },
    {
      "name": "keystone",
      "status": "fixed",
      "release": "forky",
      "version": "2:30.0.0-3"
    },
    {
      "name": "keystone",
      "status": "fixed",
      "release": "trixie",
      "version": "2:27.0.0-3+deb13u5"
    },
    {
      "name": "keystone",
      "status": "fixed",
      "release": "trixie-security",
      "version": "2:27.0.0-3+deb13u6"
    },
    {
      "name": "keystone",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "2:22.0.2-0+deb12u3"
    },
    {
      "name": "keystone",
      "status": "vulnerable",
      "release": "bookworm-security",
      "version": "2:22.0.2-0+deb12u6"
    }
  ],
  "fixed_versions": [
    {
      "bug": 989998,
      "name": "keystone",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "2:23.0.0-3"
    },
    {
      "bug": 989998,
      "name": "keystone",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "2:23.0.0-3"
    },
    {
      "bug": 989998,
      "name": "keystone",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "2:23.0.0-3"
    },
    {
      "bug": 989998,
      "name": "keystone",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "keystone",
      "fixed_version": "not yet fixed",
      "applicability_unknown": true
    },
    {
      "name": "keystone",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "2:16.0.0-0ubuntu1",
        "2:17.0.0~b1~git2019121613.db81fee63-0ubuntu1",
        "2:17.0.0~b2~git2020020513.99733f172-0ubuntu1",
        "2:17.0.0~b3~git2020032415.9f9040257-0ubuntu1",
        "2:17.0.0~b3~git2020032415.9f9040257-0ubuntu2",
        "2:17.0.0~b3~git2020041013.7bb6314e4-0ubuntu1",
        "2:17.0.0-0ubuntu0.20.04.1",
        "2:17.0.1-0ubuntu1",
        "2:17.0.1-0ubuntu2",
        "2:17.0.1-0ubuntu2+esm1",
        "2:17.0.1-0ubuntu2+esm2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-3563",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-3563",
      "provider_updated_at": "2026-09-30T18:21:23.353716982Z",
      "applicability_unknown": true
    },
    {
      "name": "keystone",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:21.0.1-0ubuntu2.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "2:20.0.0-0ubuntu1",
        "2:20.0.0+git2021120815.2ddf8f321-0ubuntu1",
        "2:20.0.0+git2022011217.771c943ad-0ubuntu1",
        "2:20.0.0+git2022030313.a3fc9e7c3-0ubuntu1",
        "2:21.0.0-0ubuntu1",
        "2:21.0.1-0ubuntu1",
        "2:21.0.1-0ubuntu2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2021-3563",
      "fixed_version": "2:21.0.1-0ubuntu2.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2021-3563",
      "provider_updated_at": "2026-09-30T18:21:23.353716982Z",
      "applicability_unknown": true
    },
    {
      "name": "keystone",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2:21.0.1-0ubuntu2.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "2:20.0.0-0ubuntu1",
        "2:20.0.0+git2021120815.2ddf8f321-0ubuntu1",
        "2:20.0.0+git2022011217.771c943ad-0ubuntu1",
        "2:20.0.0+git2022030313.a3fc9e7c3-0ubuntu1",
        "2:21.0.0-0ubuntu1",
        "2:21.0.1-0ubuntu1",
        "2:21.0.1-0ubuntu2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-7926-1",
      "fixed_version": "2:21.0.1-0ubuntu2.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-7926-1",
      "provider_updated_at": "2026-04-27T18:31:24.877333Z",
      "applicability_unknown": true
    }
  ]
}

[Debian bug #989998]

Publisher notes

[bookworm] keystone: Minor issue

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[keystone]Unknown
Details (4)
- 2:22.0.2-0+deb12u3 · all · bookworm
  Affected
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
- 2:22.0.2-0+deb12u3 · all · bookworm
  Affected
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
- 2:22.0.2-0+deb12u3 · all · bookworm-security
  Affected
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
- 2:22.0.2-0+deb12u3 · all · bookworm-security
  Affected
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
[keystone-doc]Unknown
Source package: [keystone]
Details (4)
- 2:22.0.2-0+deb12u3 · all · bookworm
  Affected
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
- 2:22.0.2-0+deb12u3 · all · bookworm
  Affected
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
- 2:22.0.2-0+deb12u3 · all · bookworm-security
  Affected
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
- 2:22.0.2-0+deb12u3 · all · bookworm-security
  Affected
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
[python3-keystone]Unknown
Source package: [keystone]
Details (4)
- 2:22.0.2-0+deb12u3 · all · bookworm
  Affected
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
- 2:22.0.2-0+deb12u3 · all · bookworm
  Affected
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
- 2:22.0.2-0+deb12u3 · all · bookworm-security
  Affected
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12
- 2:22.0.2-0+deb12u3 · all · bookworm-security
  Affected
  dsa · keystone · debian · bookworm; dsa · keystone · debian · 12

[Debian 13 (Trixie)]

[keystone]Unknown
Details (6)
- 2:27.0.0-3+deb13u4 · all · trixie
  Fixed · Fixed: 2:23.0.0-3
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u4 · all · trixie
  Fixed · Fixed: 2:23.0.0-3
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u4 · all · trixie-security
  Fixed · Fixed: 2:23.0.0-3
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u4 · all · trixie-security · Historical version
  Fixed · Fixed: 2:23.0.0-3
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u5 · all · trixie-security · Historical version
  Fixed · Fixed: 2:23.0.0-3
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u6 · all · trixie-security
  Fixed · Fixed: 2:23.0.0-3
  dsa · keystone · debian · 13
[keystone-doc]Unknown
Source package: [keystone]
Details (6)
- 2:27.0.0-3+deb13u4 · all · trixie
  Fixed · Fixed: 2:23.0.0-3
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u4 · all · trixie
  Fixed · Fixed: 2:23.0.0-3
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u4 · all · trixie-security
  Fixed · Fixed: 2:23.0.0-3
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u4 · all · trixie-security · Historical version
  Fixed · Fixed: 2:23.0.0-3
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u5 · all · trixie-security · Historical version
  Fixed · Fixed: 2:23.0.0-3
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u6 · all · trixie-security
  Fixed · Fixed: 2:23.0.0-3
  dsa · keystone · debian · 13
[python3-keystone]Unknown
Source package: [keystone]
Details (6)
- 2:27.0.0-3+deb13u4 · all · trixie
  Fixed · Fixed: 2:23.0.0-3
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u4 · all · trixie
  Fixed · Fixed: 2:23.0.0-3
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u4 · all · trixie-security
  Fixed · Fixed: 2:23.0.0-3
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u4 · all · trixie-security · Historical version
  Fixed · Fixed: 2:23.0.0-3
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u5 · all · trixie-security · Historical version
  Fixed · Fixed: 2:23.0.0-3
  dsa · keystone · debian · 13
- 2:27.0.0-3+deb13u6 · all · trixie-security
  Fixed · Fixed: 2:23.0.0-3
  dsa · keystone · debian · 13

Observed: Oct 23, 2026, 5:58:33 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]