CVE-2013-2166

CriticalCVSS 9.8/10Last modified Jun 16, 2026

Description

python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-326

Affected software

Vendor	Product	Versions
python-keystoneclient	python-keystoneclient	< 0.2.6

References

http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113944.htmlMailing List, Release Notes, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0992.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2013/06/19/5Issue Tracking, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/60684Third Party Advisory, VDB Entry
https://access.redhat.com/security/cve/cve-2013-2166Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2166Exploit, Issue Tracking, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-2166Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2013-2166Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2013-August/113944.htmlMailing List, Release Notes, Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2013-0992.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2013/06/19/5Issue Tracking, Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/60684Third Party Advisory, VDB Entry
https://access.redhat.com/security/cve/cve-2013-2166Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-2166Exploit, Issue Tracking, Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2013-2166Issue Tracking, Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2013-2166Third Party Advisory

Timeline

Published: Dec 10, 2019
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-21679.8python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass CVE-2013-21681.9The _dbus_printf_string_upper_bound function in dbus/dbus-sysdeps-unix.c in D-Bus (aka DBus) 1.4.x before 1.4.26, 1.6.x before 1.6.12, and 1 CVE-2013-21716.9The vm_map_lookup function in sys/vm/vm_map.c in the mmap implementation in the kernel in FreeBSD 9.0 through 9.1-RELEASE-p4 does not proper CVE-2013-21724.3jcp/xml/dsig/internal/dom/DOMCanonicalizationMethod.java in Apache Santuario XML Security for Java 1.4.x before 1.4.8 and 1.5.x before 1.5.5 CVE-2013-21734.3wp-includes/class-phpass.php in WordPress 3.5.1, when a password-protected post exists, allows remote attackers to cause a denial of service CVE-2013-21746.8Heap-based buffer overflow in the curl_easy_unescape function in lib/escape.c in cURL and libcurl 7.7 through 7.30.0 allows remote attackers CVE-2013-21755.0HAProxy 1.4 before 1.4.24 and 1.5 before 1.5-dev19, when configured to use hdr_ip or other "hdr_*" functions with a negative occurrence coun CVE-2013-21767.2Unquoted Windows search path vulnerability in the Red Hat Enterprise Virtualization Application Provisioning Tool (RHEV-APT) in the rhev-gue CVE-2013-21774.3Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-1.x before 7.x-1.7 and 7.x-2.x before 7.x-2.3 for Drupal allows rem CVE-2013-21785.0The apache-auth.conf, apache-nohome.conf, apache-noscript.conf, and apache-overflows.conf files in Fail2ban before 0.8.10 do not properly va CVE-2013-21794.3X.Org xdm 1.1.10, 1.1.11, and possibly other versions, when performing authentication using certain implementations of the crypt API functio CVE-2013-21814.3Cross-site scripting (XSS) vulnerability in the Directory Listing plugin in Monkey HTTP Daemon (monkeyd) 1.2.2 allows attackers to inject ar