CVE-2016-4911 OpenStack Identity Keystone Improper Access Control
MediumCVSS 4.3
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Fernet Token Provider in OpenStack Identity (Keystone) 9.0.x before 9.0.1 (mitaka) allows remote authenticated users to prevent revocation of a chain of tokens and bypass intended access restrictions by rescoping a token.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi keystone(PyPI) | >= 9.0.0, < 9.0.1 | 9.0.1 |
| debian/keystone(Debian:12) | < 2:9.0.0-2 | 2:9.0.0-2 |
| debian/keystone(Debian:13) | < 2:9.0.0-2 | 2:9.0.0-2 |
| debian/keystone(Debian:14) | < 2:9.0.0-2 | 2:9.0.0-2 |
| keystone openstack identity | = 9.0.0.0-rc1 | No fix listed |
| keystone openstack identity | = 9.0.0.0-rc2 | No fix listed |
| keystone openstack identity | = 9.0.0.0-rc3 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- bugs.launchpad.net vendor-advisory
- github.com product
- github.com
- review.openstack.org vendor-advisory
- security.openstack.org patch vendor-advisory
- [oss-security] 20160517 CVE request for vulnerability in OpenStack Keystone mailing-list technical-description
- [oss-security] 20160517 Re: CVE request for vulnerability in OpenStack Keystone mailing-list technical-description
- 90728 third-party-advisory vdb-entry vendor-advisory
- Debian Security Tracker CVE-2016-4911 vendor-advisory
- github.com
- bugs.debian.org issue-tracking