OpenStack Keystone vulnerability

2013-11-2500:00:00

ubuntu.com

6.3 Medium

AI Score

Confidence

Low

3.3 Low

CVSS2

Access Vector

LOCAL

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:L/AC:M/Au:N/C:P/I:P/A:N

0.0004 Low

EPSS

Percentile

5.2%

JSON

Releases

Ubuntu 13.10
Ubuntu 13.04
Ubuntu 12.10

Packages

keystone - OpenStack identity service

Details

Brant Knudson discovered a logic error in the LDAP backend in Keystone
where removing a role on a tenant for a user who does not have that role
would instead add the role to the user. An authenticated user could use
this to gain privileges. Ubuntu is not configured to use the LDAP Keystone
backend by default.

OSVersionArchitecturePackageVersionFilename
Ubuntu13.10noarchpython-keystone< 1:2013.2-0ubuntu1.1UNKNOWN
Ubuntu13.10noarchkeystone< 1:2013.2-0ubuntu1.1UNKNOWN
Ubuntu13.10noarchkeystone-doc< 1:2013.2-0ubuntu1.1UNKNOWN
Ubuntu13.04noarchpython-keystone< 1:2013.1.4-0ubuntu1.1UNKNOWN
Ubuntu13.04noarchkeystone< 1:2013.1.4-0ubuntu1.1UNKNOWN
Ubuntu13.04noarchkeystone-doc< 1:2013.1.4-0ubuntu1.1UNKNOWN
Ubuntu12.10noarchpython-keystone< 2012.2.4-0ubuntu3.3UNKNOWN
Ubuntu12.10noarchkeystone< 2012.2.4-0ubuntu3.3UNKNOWN
Ubuntu12.10noarchkeystone-doc< 2012.2.4-0ubuntu3.3UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	13.10	noarch	python-keystone	< 1:2013.2-0ubuntu1.1	UNKNOWN
Ubuntu	13.10	noarch	keystone	< 1:2013.2-0ubuntu1.1	UNKNOWN
Ubuntu	13.10	noarch	keystone-doc	< 1:2013.2-0ubuntu1.1	UNKNOWN
Ubuntu	13.04	noarch	python-keystone	< 1:2013.1.4-0ubuntu1.1	UNKNOWN
Ubuntu	13.04	noarch	keystone	< 1:2013.1.4-0ubuntu1.1	UNKNOWN
Ubuntu	13.04	noarch	keystone-doc	< 1:2013.1.4-0ubuntu1.1	UNKNOWN
Ubuntu	12.10	noarch	python-keystone	< 2012.2.4-0ubuntu3.3	UNKNOWN
Ubuntu	12.10	noarch	keystone	< 2012.2.4-0ubuntu3.3	UNKNOWN
Ubuntu	12.10	noarch	keystone-doc	< 2012.2.4-0ubuntu3.3	UNKNOWN