GitHub Advisoryadvisory · PyPI

GHSA-23x9-8hxr-978c OpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend

HIGH Published 2022-05-17 Modified 2025-04-13 Official page ↗
Aliases
CVE-2014-2237
Ecosystem
PyPI
Packages
keystone
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-1270, CWE-287
Reviewed
2024-05-14

Affected packages

• PyPI keystone: < 8.0.0a0 → fixed in 8.0.0a0

Description

The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.

Related

Alias · CVE (1)

  • CVE-2014-2237 The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before… vulnerability

Weakness · CWE (2)

  • CWE-1270 Generation of Incorrect Security Tokens weakness
  • CWE-287 Improper Authentication weakness

References