CVE-2014-5251

2014-08-2514:55:07

CWE-255

[email protected]

web.nvd.nist.gov

CVSS2

4.9

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:P/I:P/A:N

AI Score

6.1

Confidence

Low

EPSS

0.002

Percentile

56.3%

JSON

The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token.

Affected configurations

Nvd

Node

openstackkeystoneMatch2014.1

openstackkeystoneMatch2014.1.2

openstackkeystoneMatchjuno-1

openstackkeystoneMatchjuno-2

canonicalubuntu_linuxMatch14.04lts

VendorProductVersionCPE
openstackkeystone2014.1cpe:2.3:a:openstack:keystone:2014.1:*:*:*:*:*:*:*
openstackkeystone2014.1.2cpe:2.3:a:openstack:keystone:2014.1.2:*:*:*:*:*:*:*
openstackkeystonejuno-1cpe:2.3:a:openstack:keystone:juno-1:*:*:*:*:*:*:*
openstackkeystonejuno-2cpe:2.3:a:openstack:keystone:juno-2:*:*:*:*:*:*:*
canonicalubuntu_linux14.04cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*

Vendor	Product	Version	CPE
openstack	keystone	2014.1	cpe:2.3:a:openstack:keystone:2014.1:::::::*
openstack	keystone	2014.1.2	cpe:2.3:a:openstack:keystone:2014.1.2:::::::*
openstack	keystone	juno-1	cpe:2.3:a:openstack:keystone:juno-1:::::::*
openstack	keystone	juno-2	cpe:2.3:a:openstack:keystone:juno-2:::::::*
canonical	ubuntu_linux	14.04	cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::