CVE-2013-2104 python-keystoneclient missing expiration check in PKI token validation
MediumCVSS 5.5
EPSS 2.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remote authenticated users to (1) retain use of a token after it has expired, or (2) use a revoked token once it expires.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi python-keystoneclient(PyPI) | < 0.2.4 | 0.2.4 |
| pypi python-keystoneclient(PyPI) | = 0.1.1 | No fix listed |
| pypi python-keystoneclient(PyPI) | = 0.1.2 | No fix listed |
| pypi python-keystoneclient(PyPI) | = 0.1.3 | No fix listed |
| pypi python-keystoneclient(PyPI) | = 0.2.0 | No fix listed |
| pypi python-keystoneclient(PyPI) | = 0.2.1 | No fix listed |
| pypi python-keystoneclient(PyPI) | = 0.2.2 | No fix listed |
| pypi python-keystoneclient(PyPI) | = 0.2.3 | No fix listed |
| debian/python-keystoneclient(Debian:12) | < 1:0.2.5-1 | 1:0.2.5-1 |
| debian/python-keystoneclient(Debian:13) | < 1:0.2.5-1 | 1:0.2.5-1 |
| debian/python-keystoneclient(Debian:14) | < 1:0.2.5-1 | 1:0.2.5-1 |
| OpenStack python-keystoneclient | <= 0.2.3 | No fix listed |
| OpenStack python-keystoneclient | = 0.2.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- access.redhat.com
- access.redhat.com
- bugs.launchpad.net
- bugzilla.redhat.com
- github.com product
- github.com
- openSUSE-SU-2013:1089 vendor-advisory
- RHSA-2013:0944 vendor-advisory
- [oss-security] 20130528 [OSSA 2013-014] Missing expiration check in Keystone PKI tokens validation (CVE-2013-2104) mailing-list
- USN-1851-1 vendor-advisory
- USN-1875-1 vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2013-2104 vendor-advisory