PT-2014-6369 · Openstack+1 · Openstack Identity+1

Blk-U + 1 · Published 2014-08-15 · Updated 2022-05-17 · CVE-2014-5253

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Identity (Keystone) versions 2014.1.x before 2014.1.2.1 OpenStack Identity (Keystone) version Juno before Juno-3

Description The issue allows remote authenticated users to retain access via a domain-scoped token for an invalidated domain. This occurs because OpenStack Identity (Keystone) does not properly revoke tokens when a domain is invalidated.

Recommendations For OpenStack Identity (Keystone) versions 2014.1.x before 2014.1.2.1, update to version 2014.1.2.1 or later to resolve the issue. For OpenStack Identity (Keystone) version Juno before Juno-3, update to Juno-3 or later to resolve the issue.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-255

CWE-613

Related Identifiers

CVE-2014-5253

GHSA-77W8-QV8M-386H

PYSEC-2014-109

RHSA-2014:1121

RHSA-2014:1122

USN-2324-1

Affected Products

Openstack Identity

Ubuntu

References · 28

• https://osv.dev/vulnerability/CVE-2014-5253 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-5253 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-5253 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-5253 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1121.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-5252 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3476 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-5253 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-77w8-qv8m-386h · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2014-109 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2324-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-5253 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1122.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-5253 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-3520 · Vendor Advisory