GitHub Advisoryadvisory · PyPI
GHSA-5qpp-v56f-mqfm OpenStack Identity (Keystone) allows remote attackers to bypass intended access restrictions via revoked PKI token
MEDIUM
Official page ↗
- Aliases
- CVE-2013-4294
- Ecosystem
- PyPI
- Packages
- keystone
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Reviewed
- 2023-02-08
Affected packages
• PyPI keystone: >= 2012.2.0, < 2013.1.4 → fixed in 2013.1.4
Description
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
Related
Alias · CVE (1)
- CVE-2013-4294 The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly… vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-4294 advisory
- https://access.redhat.com/errata/RHSA-2013:1285 web
- https://access.redhat.com/security/cve/CVE-2013-4294 web
- https://bugs.launchpad.net/keystone/+bug/1202952 web
- https://bugzilla.redhat.com/show_bug.cgi?id=1004452 web
- https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2013-42.yaml web
- https://opendev.org/openstack/keystone package
- http://rhn.redhat.com/errata/RHSA-2013-1285.html web
- http://seclists.org/oss-sec/2013/q3/586 web
- http://www.ubuntu.com/usn/USN-2002-1 web