PT-2022-16707 · Keystone+3 · Keystone+3

Sage Mctaggart · Published 2022-09-01 · Updated 2025-12-11 · CVE-2022-2447

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Keystone (affected versions not specified)

Description A flaw was found in Keystone, where there is a time lag of up to one hour in the default configuration between when the security policy says a token should be revoked and when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected. The issue is related to the revocation of token access, potentially allowing an authenticated remote attacker to obtain access despite efforts to remove it.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-324

CWE-672

Related Identifiers

CVE-2022-2447

USN-7926-1

Affected Products

Debian

Keystone

Linuxmint

Ubuntu

References · 16

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=2105419 · Exploit
• https://cve.org/CVERecord?id=CVE-2022-2447 · Security Note
• https://ubuntu.com/security/CVE-2022-2447 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-2447 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-2447 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-65073 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-2447 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7926-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-3563 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7926-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-2447 · Security Note
• https://access.redhat.com/security/cve/CVE-2022-2447 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-2447 · Vendor Advisory
• https://t.me/cvenotify/35813 · Telegram Post
• https://t.me/cvenotify/36456 · Telegram Post