PT-2014-6367 · Openstack+1 · Openstack Identity+1

Blk-U + 1 · Publicado 2014-08-15 · Atualizado 2022-05-17 · CVE-2014-5251

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Identity (Keystone) versions 2014.1.x before 2014.1.2.1 OpenStack Identity (Keystone) version Juno before Juno-3

Description The issue is related to the MySQL token driver in OpenStack Identity (Keystone), where timestamps are stored with incorrect precision. This causes the expiration comparison for tokens to fail, allowing remote authenticated users to retain access via an expired token.

Recommendations For OpenStack Identity (Keystone) versions 2014.1.x before 2014.1.2.1, update to version 2014.1.2.1 or later to resolve the issue. For OpenStack Identity (Keystone) version Juno before Juno-3, update to Juno-3 or later to resolve the issue.

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-255

CWE-613

Identificadores relacionados

CVE-2014-5251

GHSA-GMVP-5RF9-MXCM

PYSEC-2014-107

RHSA-2014:1121

RHSA-2014:1122

USN-2324-1

Produtos afetados

Openstack Identity

Ubuntu

Referências · 26

• https://github.com/openstack/keystone · Nota
• https://github.com/openstack/keystone/commit/6cbf835542d62e6e5db4b4aef7141b1731cad9dc · Nota
• https://github.com/openstack/keystone/commit/7aee6304f653475a4130dc3e5be602e91481f108 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2014-107.yaml · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-5251 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2014-5251 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2014-1121.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-5252 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-3476 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-5251 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-gmvp-5rf9-mxcm · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-2324-1 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2014-1122.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-5253 · Aviso do Fabricante
• https://git.openstack.org/cgit/openstack/keystone/commit/?id=6cbf835542d62e6e5db4b4aef7141b1731cad9dc · Nota