GitHub Advisoryadvisory · PyPI

GHSA-4rrr-j7ff-r844 python-keystoneclient missing expiration check in PKI token validation

HIGH Published 2022-05-17 Modified 2024-10-25 Official page ↗
Aliases
CVE-2013-2104
Ecosystem
PyPI
Packages
python-keystoneclient
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-324
Reviewed
2023-08-29

Affected packages

• PyPI python-keystoneclient: < 0.2.4 → fixed in 0.2.4

Description

python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remote authenticated users to (1) retain use of a token after it has expired, or (2) use a revoked token once it expires.

Related

Alias · CVE (1)

  • CVE-2013-2104 python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows… vulnerability

Weakness · CWE (1)

  • CWE-324 Use of a Key Past its Expiration Date weakness

References