Veracode Vulnerability DatabaseVERACODE:11415Improper Token Invalidation
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P
The openstack-keystone packages is vulnerable to improper token invalidation. It is possible because it does not revoke the tokens issued to a tenant upon disabling the tenant, leaving the tenant to access the resources supposed to be restricted.
References
lists.fedoraproject.org/pipermail/package-announce/2013-September/116489.html
rhn.redhat.com/errata/RHSA-2013-1524.html
www.ubuntu.com/usn/USN-2002-1
access.redhat.com/errata/RHSA-2013:1524
access.redhat.com/security/cve/CVE-2013-4222
access.redhat.com/security/updates/classification/#moderate
bugs.launchpad.net/ossn/+bug/1179955
bugzilla.redhat.com/show_bug.cgi?id=1012694
bugzilla.redhat.com/show_bug.cgi?id=995598
rhn.redhat.com/errata/RHSA-2013-1524.html
Related
6.5 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:S/C:P/I:P/A:P