OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events
The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2014-5251US | medium4.9 | — | ||
The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiratio… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://rhn.redhat.com/errata/RHSA-2014-1121.htmlWEB
- http://rhn.redhat.com/errata/RHSA-2014-1122.htmlWEB
- http://www.openwall.com/lists/oss-security/2014/08/15/6WEB
- http://www.ubuntu.com/usn/USN-2324-1WEB
- https://bugs.launchpad.net/keystone/+bug/1347961WEB
- https://github.com/openstack/keystonePACKAGE
- https://github.com/openstack/keystone/commit/6cbf835542d62e6e5db4b4aef7141b1731cad9dcWEB
- https://github.com/openstack/keystone/commit/7aee6304f653475a4130dc3e5be602e91481f108WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan