CVE-2014-5252

2014-08-2514:55:07

Debian Security Bug Tracker

security-tracker.debian.org

4.9 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

0.002 Low

EPSS

Percentile

54.0%

JSON

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.

OSVersionArchitecturePackageVersionFilename
Debian12allkeystone< 2014.1.2.1-1keystone_2014.1.2.1-1_all.deb
Debian11allkeystone< 2014.1.2.1-1keystone_2014.1.2.1-1_all.deb
Debian999allkeystone< 2014.1.2.1-1keystone_2014.1.2.1-1_all.deb
Debian13allkeystone< 2014.1.2.1-1keystone_2014.1.2.1-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	keystone	< 2014.1.2.1-1	keystone_2014.1.2.1-1_all.deb
Debian	11	all	keystone	< 2014.1.2.1-1	keystone_2014.1.2.1-1_all.deb
Debian	999	all	keystone	< 2014.1.2.1-1	keystone_2014.1.2.1-1_all.deb
Debian	13	all	keystone	< 2014.1.2.1-1	keystone_2014.1.2.1-1_all.deb