OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events
The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2014-5251US | medium4.9 | — | ||
The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiratio… | ||||
02
references
External citations — patches, advisories, analysis.
- http://rhn.redhat.com/errata/RHSA-2014-1121.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2014-1122.htmlWEB
- http://www.openwall.com/lists/oss-security/2014/08/15/6WEB
- http://www.ubuntu.com/usn/USN-2324-1WEB
- https://bugs.launchpad.net/keystone/+bug/1347961WEB
- https://github.com/openstack/keystonePACKAGE
- https://github.com/openstack/keystone/commit/6cbf835542d62e6e5db4b4aef7141b1731cad9dcWEB
- https://github.com/openstack/keystone/commit/7aee6304f653475a4130dc3e5be602e91481f108WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan