CVE-2013-4294 OpenStack Identity (Keystone) allows remote attackers to bypass intended access restrictions via revoked PKI token
MediumCVSS 5.0
EPSS 2.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi keystone(PyPI) | >= 2012.2.0, < 2013.1.4 | 2013.1.4 |
| debian/keystone(Debian:12) | < 2013.1.3-2 | 2013.1.3-2 |
| debian/keystone(Debian:13) | < 2013.1.3-2 | 2013.1.3-2 |
| debian/keystone(Debian:14) | < 2013.1.3-2 | 2013.1.3-2 |
| OpenStack Keystone | = 2012.2 | No fix listed |
| OpenStack Keystone | = 2012.2.1 | No fix listed |
| OpenStack Keystone | = 2012.2.2 | No fix listed |
| OpenStack Keystone | = 2012.2.3 | No fix listed |
| OpenStack Keystone | = 2012.2.4 | No fix listed |
| OpenStack Keystone | = 2013.1 | No fix listed |
| OpenStack Keystone | = 2013.1.1 | No fix listed |
| OpenStack Keystone | = 2013.1.2 | No fix listed |
| OpenStack Keystone | = 2013.1.3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- access.redhat.com
- access.redhat.com
- bugs.launchpad.net vendor-advisory
- bugzilla.redhat.com
- github.com
- opendev.org product
- RHSA-2013:1285 vendor-advisory
- [oss-security] 20130911 [OSSA 2013-025] Token revocation failure using Keystone memcache/KVS backends (CVE-2013-4294) mailing-list patch
- USN-2002-1 vendor-advisory
- 97237 vdb-entry
- 54706 third-party-advisory vendor-advisory
- Debian Security Tracker CVE-2013-4294 vendor-advisory
- github.com
- bugs.debian.org issue-tracking