PT-2014-6367 · Openstack+1 · Openstack Identity+1

Blk-U + 1 · Published 2014-08-15 · Updated 2022-05-17 · CVE-2014-5251

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Identity (Keystone) versions 2014.1.x before 2014.1.2.1 OpenStack Identity (Keystone) version Juno before Juno-3

Description The issue is related to the MySQL token driver in OpenStack Identity (Keystone), where timestamps are stored with incorrect precision. This causes the expiration comparison for tokens to fail, allowing remote authenticated users to retain access via an expired token.

Recommendations For OpenStack Identity (Keystone) versions 2014.1.x before 2014.1.2.1, update to version 2014.1.2.1 or later to resolve the issue. For OpenStack Identity (Keystone) version Juno before Juno-3, update to Juno-3 or later to resolve the issue.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-255

CWE-613

Related Identifiers

CVE-2014-5251

GHSA-GMVP-5RF9-MXCM

PYSEC-2014-107

RHSA-2014:1121

RHSA-2014:1122

USN-2324-1

Affected Products

Openstack Identity

Ubuntu

References · 26

• https://osv.dev/vulnerability/UBUNTU-CVE-2014-5251 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-5251 · Security Note
• http://rhn.redhat.com/errata/RHSA-2014-1121.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-5252 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3476 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-5251 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gmvp-5rf9-mxcm · Vendor Advisory
• https://osv.dev/vulnerability/USN-2324-1 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1122.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-5253 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-107 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-5251 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3520 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2324-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-5251 · Security Note