PT-2014-6369 · Openstack+1 · Openstack Identity+1

Blk-U + 1 · Publicado 2014-08-15 · Atualizado 2022-05-17 · CVE-2014-5253

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Identity (Keystone) versions 2014.1.x before 2014.1.2.1 OpenStack Identity (Keystone) version Juno before Juno-3

Description The issue allows remote authenticated users to retain access via a domain-scoped token for an invalidated domain. This occurs because OpenStack Identity (Keystone) does not properly revoke tokens when a domain is invalidated.

Recommendations For OpenStack Identity (Keystone) versions 2014.1.x before 2014.1.2.1, update to version 2014.1.2.1 or later to resolve the issue. For OpenStack Identity (Keystone) version Juno before Juno-3, update to Juno-3 or later to resolve the issue.

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-255

CWE-613

Identificadores relacionados

CVE-2014-5253

GHSA-77W8-QV8M-386H

PYSEC-2014-109

RHSA-2014:1121

RHSA-2014:1122

USN-2324-1

Produtos afetados

Openstack Identity

Ubuntu

Referências · 28

• https://github.com/openstack/keystone · Nota
• https://github.com/openstack/keystone/commit/317f9d34b4da20c21edd5b851889298b67c843e1 · Nota
• https://github.com/openstack/keystone/commit/cccc3f3239c68479de0f6a41bd64badf2a9ec9e7 · Nota
• https://github.com/openstack/keystone/commit/c4447f16da036fe878382ce4e1b05b84bdcc4d4e · Nota
• https://github.com/openstack/keystone/commit/3e035ebb726167aef43c4a865c7e7f7d3b0978fb · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2014-109.yaml · Nota
• https://osv.dev/vulnerability/CVE-2014-5253 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2014-5253 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-5253 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2014-5253 · Aviso do Fabricante
• https://git.openstack.org/cgit/openstack/keystone/commit/?id=317f9d34b4da20c21edd5b851889298b67c843e1 · Nota
• http://rhn.redhat.com/errata/RHSA-2014-1121.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-5252 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-3476 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-5253 · Aviso do Fabricante