GitHub Advisoryadvisory · PyPI

GHSA-v8fq-gq9j-3v7h OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events

HIGH Published 2022-05-17 Modified 2024-11-26 Official page ↗
Aliases
CVE-2014-5252
Ecosystem
PyPI
Packages
keystone
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-613
Reviewed
2024-05-14

Affected packages

• PyPI keystone: < 8.0.0a0 → fixed in 8.0.0a0

Description

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2014-5252 The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2… vulnerability

References