GitHub Advisoryadvisory · PyPI

GHSA-274v-r947-v34r OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege

MEDIUM Published 2022-05-13 Modified 2024-05-14 Official page ↗
Aliases
CVE-2014-3476
Ecosystem
PyPI
Packages
keystone
Severity
Moderate
Weaknesses
CWE-269
Reviewed
2024-05-14

Affected packages

• PyPI keystone: < 8.0.0a0 → fixed in 8.0.0a0

Description

OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonation enabled to create a new token with additional roles.

Related

Alias · CVE (1)

  • CVE-2014-3476 OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation,… vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References