GitHub Advisory DatabaseGHSA-23X9-8HXR-978COpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
AI Score
Confidence
High
EPSS
Percentile
69.2%
The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trusteeโs token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.
Affected configurations
References
rhn.redhat.com/errata/RHSA-2014-0580.html
www.openwall.com/lists/oss-security/2014/03/04/16
www.securityfocus.com/bid/65895
bugs.launchpad.net/keystone/+bug/1260080
github.com/advisories/GHSA-23x9-8hxr-978c
github.com/openstack/keystone/commit/813d1254eb4f7a7d40009b23bbadbc4c5cc5daac
github.com/openstack/keystone/commit/a411c944af78c36f2fdb87d305ba452dc52d7ed3
github.com/openstack/keystone/commit/b6f0e26da0e2ab0892a5658da281a065e668637b
nvd.nist.gov/vuln/detail/CVE-2014-2237
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:L/Au:N/C:N/I:P/A:N
AI Score
Confidence
High
EPSS
Percentile
69.2%