GitHub Advisoryadvisory · PyPI

GHSA-8c4w-v65p-jvcv OpenStack Identity Keystone and keystonemiddleware Insufficiently Protected Credentials

HIGH Published 2022-05-13 Modified 2024-09-27 Official page ↗
Aliases
CVE-2015-7546
Ecosystem
PyPI
Packages
keystone, keystonemiddleware
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-522
Reviewed
2024-04-29

Affected packages

• PyPI keystone: >= 9.0.0.0b1, < 9.0.0.0b2 → fixed in 9.0.0.0b2 • PyPI keystonemiddleware: >= 2.4.0, < 4.1.0 → fixed in 4.1.0 • PyPI keystone: >= 8.0, < 8.1.0 → fixed in 8.1.0 • PyPI keystonemiddleware: < 1.5.4 → fixed in 1.5.4 • PyPI keystonemiddleware: >= 1.6.0, < 2.3.3 → fixed in 2.3.3

Description

The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers, which allows remote authenticated users to bypass intended access restrictions and gain access to cloud resources by manipulating byte fields within a revoked token.

Related

Alias · CVE (1)

  • CVE-2015-7546 The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware… vulnerability

Weakness · CWE (1)

  • CWE-522 Insufficiently Protected Credentials weakness

References