PYSEC-2014-107

vendorUSosv

view advisory published 2014-08-25Licence: CC-BY-4.0

The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2014-5251US	medium4.9	1.59% (76th)	—	2014-08-25
The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiratio…

references

External citations — patches, advisories, analysis.

http://rhn.redhat.com/errata/RHSA-2014-1121.htmlADVISORY
http://rhn.redhat.com/errata/RHSA-2014-1122.htmlADVISORY
http://www.openwall.com/lists/oss-security/2014/08/15/6WEB
http://www.ubuntu.com/usn/USN-2324-1ADVISORY
https://bugs.launchpad.net/keystone/+bug/1347961WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan