PT-2016-3807 · Openstack · Liberty+2

Nathan Kinder · Publicado 2016-02-03 · Atualizado 2022-05-13 · CVE-2015-7546

Positive Technologies (AI Summary)

CVSS v4.0

8.6

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Identity (Keystone) versions prior to 2015.1.3 OpenStack Identity (Keystone) versions 8.0.x prior to 8.0.2 keystonemiddleware versions prior to 1.5.4 Liberty versions prior to 2.3.3

Description The issue is related to the improper invalidation of authorization tokens when using the PKI or PKIZ token providers. This allows remote authenticated users to bypass intended access restrictions and gain access to cloud resources by manipulating byte fields within a revoked token.

Recommendations For OpenStack Identity (Keystone) versions prior to 2015.1.3, update to version 2015.1.3 or later. For OpenStack Identity (Keystone) versions 8.0.x prior to 8.0.2, update to version 8.0.2 or later. For keystonemiddleware versions prior to 1.5.4, update to version 1.5.4 or later. For Liberty versions prior to 2.3.3, update to version 2.3.3 or later.

Correção

Insufficiently Protected Credentials

Enumeração de Fraquezas

CWE-522

Identificadores relacionados

CVE-2015-7546

GHSA-8C4W-V65P-JVCV

PYSEC-2016-20

Produtos afetados

Liberty

Openstack Identity

Keystonemiddleware

Referências · 19

• https://github.com/openstack/keystone/commit/bff03b5726fe5cac93d44a66715eea49b89c8cb0 · Nota
• https://github.com/openstack/keystone/commit/d5378f173da14a34ca010271477337879002d6d0 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/keystonemiddleware/PYSEC-2016-20.yaml · Nota
• https://github.com/openstack/keystonemiddleware/commit/96ab58e6863c92575ada57615b19652e502adfd8 · Nota
• https://security.openstack.org/ossa/OSSA-2016-005.html · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2016-20 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2015-7546 · Nota de Segurança
• http://oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html · Nota
• https://wiki.openstack.org/wiki/OSSN/OSSN-0062 · Aviso do Fabricante
• http://securityfocus.com/bid/80498 · Nota
• https://bugs.launchpad.net/keystone/+bug/1490804 · Nota
• https://ubuntu.com/security/CVE-2015-7546 · Aviso do Fabricante
• https://web.archive.org/web/20200228002640/http://securityfocus.com/bid/80498 · Nota
• https://osv.dev/vulnerability/GHSA-8c4w-v65p-jvcv · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-7546 · Nota de Segurança