CVEvulnerability
CVE-2013-4294
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2013-09-23
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-264
Description
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
Affected configurations
• openstack keystone 2012.2
• openstack keystone 2012.2.1
• openstack keystone 2012.2.2
• openstack keystone 2012.2.3
• openstack keystone 2012.2.4
• openstack keystone 2013.1
• openstack keystone 2013.1.1
• openstack keystone 2013.1.2
• openstack keystone 2013.1.3
Related
Weakness · not in database (1)
References
- http://osvdb.org/97237 osvdb.org
- http://rhn.redhat.com/errata/RHSA-2013-1285.html rhn.redhat.com
- http://seclists.org/oss-sec/2013/q3/586 Patch
- http://secunia.com/advisories/54706 secunia.com
- http://www.ubuntu.com/usn/USN-2002-1 www.ubuntu.com
- https://bugs.launchpad.net/keystone/+bug/1202952 Vendor Advisory
- http://osvdb.org/97237 osvdb.org
- http://rhn.redhat.com/errata/RHSA-2013-1285.html rhn.redhat.com
- http://seclists.org/oss-sec/2013/q3/586 Patch
- http://secunia.com/advisories/54706 secunia.com
- http://www.ubuntu.com/usn/USN-2002-1 www.ubuntu.com
- https://bugs.launchpad.net/keystone/+bug/1202952 Vendor Advisory