CVE catalog

CVE-2021-38155

keystone: CVE-2021-38155

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.48% · Oct 25, 2026

OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiankeystonesid2:30.0.0-3fixed
Debiankeystoneforky2:30.0.0-3fixed
Debiankeystonetrixie2:27.0.0-3+deb13u5fixed
Debiankeystonetrixie-security2:27.0.0-3+deb13u6fixed
Debiankeystonebookworm2:22.0.2-0+deb12u3fixed
Debiankeystonebookworm-security2:22.0.2-0+deb12u6fixed
Ubuntukeystonepro2:16.0.0-0ubuntu1vulnerable
Ubuntukeystonepro2:17.0.0~b1~git2019121613.db81fee63-0ubuntu1vulnerable
Ubuntukeystonepro2:17.0.0~b2~git2020020513.99733f172-0ubuntu1vulnerable
Ubuntukeystonepro2:17.0.0~b3~git2020032415.9f9040257-0ubuntu1vulnerable
Ubuntukeystonepro2:17.0.0~b3~git2020032415.9f9040257-0ubuntu2vulnerable
Ubuntukeystonepro2:17.0.0~b3~git2020041013.7bb6314e4-0ubuntu1vulnerable
Ubuntukeystonepro2:17.0.0-0ubuntu0.20.04.1vulnerable
Ubuntukeystonepro2:17.0.1-0ubuntu1vulnerable
Ubuntukeystonepro2:17.0.1-0ubuntu2vulnerable
Ubuntukeystonepro2:17.0.1-0ubuntu2+esm1vulnerable
Ubuntukeystonepro2:17.0.1-0ubuntu2+esm2vulnerable
Susedocumentation-hpe-helion-openstack-installationhpe helion openstack 88.20211112-1.38.1fixed
Susedocumentation-hpe-helion-openstack-operationshpe helion openstack 88.20211112-1.38.1fixed
Susedocumentation-hpe-helion-openstack-opsconsolehpe helion openstack 88.20211112-1.38.1fixed
Susedocumentation-hpe-helion-openstack-planninghpe helion openstack 88.20211112-1.38.1fixed
Susedocumentation-hpe-helion-openstack-securityhpe helion openstack 88.20211112-1.38.1fixed
Susedocumentation-hpe-helion-openstack-userhpe helion openstack 88.20211112-1.38.1fixed
Susekibanahpe helion openstack 84.6.6-3.12.1fixed
Suseopenstack-keystonehpe helion openstack 812.0.4~dev11-5.36.1fixed
Suseopenstack-keystone-dochpe helion openstack 812.0.4~dev11-5.36.1fixed
Suseopenstack-monasca-notificationhpe helion openstack 81.10.2~dev4-3.9.1fixed
Susevenv-openstack-keystonehpe helion openstack 812.0.4~dev11-11.45.1fixed
Susevenv-openstack-monascahpe helion openstack 82.2.2~dev1-11.45.1fixed
Susedocumentation-suse-openstack-cloud-installationopenstack cloud 88.20211112-1.38.1fixed
Susedocumentation-suse-openstack-cloud-operationsopenstack cloud 88.20211112-1.38.1fixed
Susedocumentation-suse-openstack-cloud-opsconsoleopenstack cloud 88.20211112-1.38.1fixed
Susedocumentation-suse-openstack-cloud-planningopenstack cloud 88.20211112-1.38.1fixed
Susedocumentation-suse-openstack-cloud-securityopenstack cloud 88.20211112-1.38.1fixed
Susedocumentation-suse-openstack-cloud-supplementopenstack cloud 88.20211112-1.38.1fixed
Susedocumentation-suse-openstack-cloud-upstream-adminopenstack cloud 88.20211112-1.38.1fixed
Susedocumentation-suse-openstack-cloud-upstream-useropenstack cloud 88.20211112-1.38.1fixed
Susedocumentation-suse-openstack-cloud-useropenstack cloud 88.20211112-1.38.1fixed
Susekibanaopenstack cloud 84.6.6-3.12.1fixed
Suseopenstack-keystoneopenstack cloud 812.0.4~dev11-5.36.1fixed
Suseopenstack-keystone-docopenstack cloud 812.0.4~dev11-5.36.1fixed
Suseopenstack-monasca-notificationopenstack cloud 81.10.2~dev4-3.9.1fixed
Susevenv-openstack-keystoneopenstack cloud 812.0.4~dev11-11.45.1fixed
Susevenv-openstack-monascaopenstack cloud 82.2.2~dev1-11.45.1fixed
Susedocumentation-suse-openstack-cloud-deploymentopenstack cloud crowbar 88.20211112-1.38.1fixed
Susedocumentation-suse-openstack-cloud-supplementopenstack cloud crowbar 88.20211112-1.38.1fixed
Susedocumentation-suse-openstack-cloud-upstream-adminopenstack cloud crowbar 88.20211112-1.38.1fixed
Susedocumentation-suse-openstack-cloud-upstream-useropenstack cloud crowbar 88.20211112-1.38.1fixed
Susekibanaopenstack cloud crowbar 84.6.6-3.12.1fixed
Suseopenstack-keystoneopenstack cloud crowbar 812.0.4~dev11-5.36.1fixed
Suseopenstack-keystone-docopenstack cloud crowbar 812.0.4~dev11-5.36.1fixed
Suseopenstack-monasca-notificationopenstack cloud crowbar 81.10.2~dev4-3.9.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiankeystonesourcesid2:19.0.0-3not yet assignedNot reported[992070]
Debiankeystonesourceforky2:19.0.0-3not yet assignedNot reported[992070]
Debiankeystonesourcetrixie2:19.0.0-3not yet assignedNot reported[992070]
Debiankeystonesourcebookworm2:19.0.0-3not yet assignedNot reported[992070]
Susedocumentation-hpe-helion-openstack-installationrpmhpe helion openstack 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susedocumentation-hpe-helion-openstack-operationsrpmhpe helion openstack 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susedocumentation-hpe-helion-openstack-opsconsolerpmhpe helion openstack 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susedocumentation-hpe-helion-openstack-planningrpmhpe helion openstack 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susedocumentation-hpe-helion-openstack-securityrpmhpe helion openstack 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susedocumentation-hpe-helion-openstack-userrpmhpe helion openstack 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susekibanarpmhpe helion openstack 84.6.6-3.12.1Not reportedSUSE-SU-2022:1654-1Not reported
Suseopenstack-keystonerpmhpe helion openstack 812.0.4~dev11-5.36.1Not reportedSUSE-SU-2022:1654-1Not reported
Suseopenstack-keystone-docrpmhpe helion openstack 812.0.4~dev11-5.36.1Not reportedSUSE-SU-2022:1654-1Not reported
Suseopenstack-monasca-notificationrpmhpe helion openstack 81.10.2~dev4-3.9.1Not reportedSUSE-SU-2022:1654-1Not reported
Susevenv-openstack-keystonerpmhpe helion openstack 812.0.4~dev11-11.45.1Not reportedSUSE-SU-2022:1654-1Not reported
Susevenv-openstack-monascarpmhpe helion openstack 82.2.2~dev1-11.45.1Not reportedSUSE-SU-2022:1654-1Not reported
Susedocumentation-suse-openstack-cloud-installationrpmopenstack cloud 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susedocumentation-suse-openstack-cloud-operationsrpmopenstack cloud 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susedocumentation-suse-openstack-cloud-opsconsolerpmopenstack cloud 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susedocumentation-suse-openstack-cloud-planningrpmopenstack cloud 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susedocumentation-suse-openstack-cloud-securityrpmopenstack cloud 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susedocumentation-suse-openstack-cloud-supplementrpmopenstack cloud 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susedocumentation-suse-openstack-cloud-upstream-adminrpmopenstack cloud 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susedocumentation-suse-openstack-cloud-upstream-userrpmopenstack cloud 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susedocumentation-suse-openstack-cloud-userrpmopenstack cloud 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susekibanarpmopenstack cloud 84.6.6-3.12.1Not reportedSUSE-SU-2022:1654-1Not reported
Suseopenstack-keystonerpmopenstack cloud 812.0.4~dev11-5.36.1Not reportedSUSE-SU-2022:1654-1Not reported
Suseopenstack-keystone-docrpmopenstack cloud 812.0.4~dev11-5.36.1Not reportedSUSE-SU-2022:1654-1Not reported
Suseopenstack-monasca-notificationrpmopenstack cloud 81.10.2~dev4-3.9.1Not reportedSUSE-SU-2022:1654-1Not reported
Susevenv-openstack-keystonerpmopenstack cloud 812.0.4~dev11-11.45.1Not reportedSUSE-SU-2022:1654-1Not reported
Susevenv-openstack-monascarpmopenstack cloud 82.2.2~dev1-11.45.1Not reportedSUSE-SU-2022:1654-1Not reported
Susedocumentation-suse-openstack-cloud-deploymentrpmopenstack cloud crowbar 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susedocumentation-suse-openstack-cloud-supplementrpmopenstack cloud crowbar 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susedocumentation-suse-openstack-cloud-upstream-adminrpmopenstack cloud crowbar 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susedocumentation-suse-openstack-cloud-upstream-userrpmopenstack cloud crowbar 88.20211112-1.38.1Not reportedSUSE-SU-2022:1654-1Not reported
Susekibanarpmopenstack cloud crowbar 84.6.6-3.12.1Not reportedSUSE-SU-2022:1654-1Not reported
Suseopenstack-keystonerpmopenstack cloud crowbar 812.0.4~dev11-5.36.1Not reportedSUSE-SU-2022:1654-1Not reported
Suseopenstack-keystone-docrpmopenstack cloud crowbar 812.0.4~dev11-5.36.1Not reportedSUSE-SU-2022:1654-1Not reported
Suseopenstack-monasca-notificationrpmopenstack cloud crowbar 81.10.2~dev4-3.9.1Not reportedSUSE-SU-2022:1654-1Not reported

[Debian bug #992070]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [keystone]Unknown
    Details (4)

    • 2:22.0.2-0+deb12u3 · all · bookworm

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · bookworm; dsa · keystone · debian · 12

    • 2:22.0.2-0+deb12u3 · all · bookworm

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · bookworm; dsa · keystone · debian · 12

    • 2:22.0.2-0+deb12u3 · all · bookworm-security

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · bookworm; dsa · keystone · debian · 12

    • 2:22.0.2-0+deb12u3 · all · bookworm-security

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · bookworm; dsa · keystone · debian · 12

  • [keystone-doc]Unknown

    Source package: [keystone]

    Details (4)

    • 2:22.0.2-0+deb12u3 · all · bookworm

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · bookworm; dsa · keystone · debian · 12

    • 2:22.0.2-0+deb12u3 · all · bookworm

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · bookworm; dsa · keystone · debian · 12

    • 2:22.0.2-0+deb12u3 · all · bookworm-security

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · bookworm; dsa · keystone · debian · 12

    • 2:22.0.2-0+deb12u3 · all · bookworm-security

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · bookworm; dsa · keystone · debian · 12

  • [python3-keystone]Unknown

    Source package: [keystone]

    Details (4)

    • 2:22.0.2-0+deb12u3 · all · bookworm

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · bookworm; dsa · keystone · debian · 12

    • 2:22.0.2-0+deb12u3 · all · bookworm

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · bookworm; dsa · keystone · debian · 12

    • 2:22.0.2-0+deb12u3 · all · bookworm-security

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · bookworm; dsa · keystone · debian · 12

    • 2:22.0.2-0+deb12u3 · all · bookworm-security

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · bookworm; dsa · keystone · debian · 12

[Debian 13 (Trixie)]

  • [keystone]Unknown
    Details (6)

    • 2:27.0.0-3+deb13u4 · all · trixie

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · 13

    • 2:27.0.0-3+deb13u4 · all · trixie

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · 13

    • 2:27.0.0-3+deb13u4 · all · trixie-security

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · 13

    • 2:27.0.0-3+deb13u4 · all · trixie-security · Historical version

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · 13

    • 2:27.0.0-3+deb13u5 · all · trixie-security · Historical version

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · 13

    • 2:27.0.0-3+deb13u6 · all · trixie-security

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · 13

  • [keystone-doc]Unknown

    Source package: [keystone]

    Details (6)

    • 2:27.0.0-3+deb13u4 · all · trixie

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · 13

    • 2:27.0.0-3+deb13u4 · all · trixie

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · 13

    • 2:27.0.0-3+deb13u4 · all · trixie-security

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · 13

    • 2:27.0.0-3+deb13u4 · all · trixie-security · Historical version

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · 13

    • 2:27.0.0-3+deb13u5 · all · trixie-security · Historical version

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · 13

    • 2:27.0.0-3+deb13u6 · all · trixie-security

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · 13

  • [python3-keystone]Unknown

    Source package: [keystone]

    Details (6)

    • 2:27.0.0-3+deb13u4 · all · trixie

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · 13

    • 2:27.0.0-3+deb13u4 · all · trixie

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · 13

    • 2:27.0.0-3+deb13u4 · all · trixie-security

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · 13

    • 2:27.0.0-3+deb13u4 · all · trixie-security · Historical version

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · 13

    • 2:27.0.0-3+deb13u5 · all · trixie-security · Historical version

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · 13

    • 2:27.0.0-3+deb13u6 · all · trixie-security

      Fixed · Fixed: 2:19.0.0-3

      dsa · keystone · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]