OpenStack Keystone vulnerability

2012-09-1300:00:00

ubuntu.com

4 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:N/I:P/A:N

6.3 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

71.7%

JSON

Releases

Ubuntu 12.04

Packages

keystone - OpenStack identity service

Details

Dolph Mathews discovered that when roles are granted and revoked to
users in Keystone, pre-existing tokens were not updated or invalidated
to take the new roles into account. An attacker could use this to
continue to access resources that have been revoked.

OSVersionArchitecturePackageVersionFilename
Ubuntu12.04noarchkeystone< 2012.1+stable~20120824-a16a0ab9-0ubuntu2.2UNKNOWN
Ubuntu12.04noarchkeystone-doc< 2012.1+stable~20120824-a16a0ab9-0ubuntu2.2UNKNOWN
Ubuntu12.04noarchpython-keystone< 2012.1+stable~20120824-a16a0ab9-0ubuntu2.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	12.04	noarch	keystone	< 2012.1+stable~20120824-a16a0ab9-0ubuntu2.2	UNKNOWN
Ubuntu	12.04	noarch	keystone-doc	< 2012.1+stable~20120824-a16a0ab9-0ubuntu2.2	UNKNOWN
Ubuntu	12.04	noarch	python-keystone	< 2012.1+stable~20120824-a16a0ab9-0ubuntu2.2	UNKNOWN