PT-2016-6182 · Openstack · Openstack Identity

Lance Bragstad · Published 2016-06-13 · Updated 2022-07-23 · CVE-2016-4911

Positive Technologies (AI Summary)

CVSS v4.0

5.3

Medium

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions OpenStack Identity (Keystone) versions 9.0.x through 9.0.0

Description The issue allows remote authenticated users to prevent revocation of a chain of tokens and bypass intended access restrictions by rescoping a token. This is related to the Fernet Token Provider in OpenStack Identity (Keystone).

Recommendations For OpenStack Identity (Keystone) versions 9.0.x through 9.0.0, update to version 9.0.1 (mitaka) to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-4911

GHSA-F82M-W3P3-CGP3

PYSEC-2016-38

Affected Products

Openstack Identity

References · 20

• https://bugs.launchpad.net/keystone/+bug/1577558 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-4911 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2016-38 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-4911 · Vendor Advisory
• https://review.openstack.org/#/c/311886 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-f82m-w3p3-cgp3 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4911 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2016-4911 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-4911 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-4911 · Vendor Advisory
• https://security.openstack.org/ossa/OSSA-2016-008.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-4911 · Vendor Advisory
• https://github.com/openstack/keystone · Note
• https://github.com/openstack/keystone/commit/0d376025bae61bf5ee19d992c7f336b99ac69240 · Note
• https://github.com/openstack/keystone/commit/ee1dc941042d1f71699971c5c30566af1b348572 · Note