CVE-2015-7546 OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials
HighCVSS 7.5
EPSS 2.0%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers, which allows remote authenticated users to bypass intended access restrictions and gain access to cloud resources by manipulating byte fields within a revoked token.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi keystone(PyPI) | >= 9.0.0.0b1, < 9.0.0.0b2 | 9.0.0.0b2 |
| pypi keystonemiddleware(PyPI) | >= 2.4.0, < 4.1.0 | 4.1.0 |
| pypi keystonemiddleware(PyPI) | = 2.4.0 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 2.4.1 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 3.0.0 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 4.0.0 | No fix listed |
| pypi keystone(PyPI) | >= 8.0, < 8.1.0 | 8.1.0 |
| pypi keystonemiddleware(PyPI) | < 1.5.4 | 1.5.4 |
| pypi keystonemiddleware(PyPI) | = 0 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 1.0.0 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 1.1.0 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 1.1.1 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 1.2.0 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 1.3.0 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 1.3.1 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 1.3.2 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 1.4.0 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 1.5.0 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 1.5.1 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 1.5.2 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 1.5.3 | No fix listed |
| pypi keystonemiddleware(PyPI) | >= 1.6.0, < 2.3.3 | 2.3.3 |
| pypi keystonemiddleware(PyPI) | = 1.6.0 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 1.6.1 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 2.0.0 | No fix listed |
Show 16 more
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi keystonemiddleware(PyPI) | = 2.1.0 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 2.2.0 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 2.3.0 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 2.3.1 | No fix listed |
| pypi keystonemiddleware(PyPI) | = 2.3.2 | No fix listed |
| debian/keystone(Debian:12) | < 2:9.0.0~rc2-1 | 2:9.0.0~rc2-1 |
| debian/keystone(Debian:13) | < 2:9.0.0~rc2-1 | 2:9.0.0~rc2-1 |
| debian/keystone(Debian:14) | < 2:9.0.0~rc2-1 | 2:9.0.0~rc2-1 |
| debian/python-keystonemiddleware(Debian:12) | < 3.0.0-1 | 3.0.0-1 |
| debian/python-keystonemiddleware(Debian:13) | < 3.0.0-1 | 3.0.0-1 |
| debian/python-keystonemiddleware(Debian:14) | < 3.0.0-1 | 3.0.0-1 |
| OpenStack keystonemiddleware | >= 1.5.0, <= 1.5.3 | No fix listed |
| OpenStack keystonemiddleware | >= 1.6.0, <= 2.3.2 | No fix listed |
| OpenStack Keystone | >= 8.0.0, < 8.0.2 | 8.0.2 |
| OpenStack Keystone | >= 2015.1.0, <= 2015.1.2 | No fix listed |
| oracle solaris | = 11.3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- bugs.launchpad.net issue-tracking third-party-advisory
- github.com
- security.openstack.org patch vendor-advisory
- web.archive.org
- wiki.openstack.org vendor-advisory
- www.oracle.com third-party-advisory
- 80498 third-party-advisory vdb-entry
- github.com vendor-advisory
- pypi.org product
- Debian Security Tracker CVE-2015-7546 vendor-advisory