TI-2013-01785 Aliases CVE-2013-2013 GHSA-8q2m-pwxf-jc7g

The user-password-update command in python-keystoneclient before 0.2.4 accepts the new…

LOW 11CWE-200Published 2013-10-01 · Updated 2024-08-06

Key facts

Attack vector: Local
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Partial · None · None
Fix status: Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

The user-password-update command in python-keystoneclient before 0.2.4 accepts the new password in the --password argument, which allows local users to obtain sensitive information by listing the process.

Why it matters now

EPSS 0.0037 31st percentileScored 2026-11-07

Fix Fixed python-keystoneclient (PyPI): 0.2.4

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	python-keystoneclient (PyPI)	before 0.2.4	0.2.4	Patch available	GHSA-8q2m-pwxf-jc7g

— Vendor— Affected all versions Fixed in — No fix listed CNA
python-keystoneclient (PyPI) Vendor— Affected before 0.2.4 Fixed in 0.2.4 Patch available GHSA-8q2m-pwxf-jc7g

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:openstack:python-keystoneclient::::::::	up to 0.2.3	Vulnerable	OpenStack
cpe:2.3:a:openstack:python-keystoneclient:0.2.2:::::::*	0.2.2	Vulnerable	OpenStack

cpe:2.3:a:openstack:python-keystoneclient:*:*:*:*:*:*:*:* Versions up to 0.2.3 Vulnerable ·OpenStack
cpe:2.3:a:openstack:python-keystoneclient:0.2.2:*:*:*:*:*:*:* Versions 0.2.2 Vulnerable ·OpenStack

Remediation

Fix · GHSA-8q2m-pwxf-jc7g python-keystoneclient (PyPI) Fixed in 0.2.4 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-10-02 Threatist record created from CVE-2013-2013
2026-10-03 Alias added: GHSA-8q2m-pwxf-jc7g

References

Patch 1

[oss-security] 20130523 [Openstack] [OSSA 2013-013] Keystone client local information disclosure (CVE-2013-2013)

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2013-2013

Other 5

TI-2013-01936 python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache signing bypass CVSS 3.1CRITICAL 9.8
TI-2013-01935 python-keystoneclient version 0.2.3 to 0.2.5 has middleware memcache encryption bypass CVSS 3.1CRITICAL 9.8
TI-2014-00100 The auth_token middleware in the OpenStack Python client library for Keystone (aka… CVSS 2.0MEDIUM 6.0
TI-2013-01873 python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not… CVSS 2.0MEDIUM 5.5
TI-2015-01663 The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and… CVSS 2.0MEDIUM 4.3
TI-2014-05964 OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x… CVSS 2.0MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences