PT-2025-47130 · Debian+4 · Keystone+4

Published 2025-11-04 · Updated 2025-12-11 · CVE-2025-65073

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

Name of the Vulnerable Software and Affected Versions OpenStack Keystone versions prior to 26.0.1 OpenStack Keystone versions 27.0.0 OpenStack Keystone versions 28.0.0 keystone version 2:18.1.0-1+deb11u2 for Debian 11 bullseye

Description The identity service, keystone, contains a flaw where sending valid AWS Signatures to the /v3/ec2tokens or /v3/s3tokens API endpoints can grant unauthorized Keystone authorization. This allows an unauthenticated attacker to gain access and potentially escalate privileges. Swift also required patching to function correctly with the updated keystone version.

Recommendations Update OpenStack Keystone to version 26.0.1 or later. Update OpenStack Keystone to version 27.0.0 or later. Update OpenStack Keystone to version 28.0.0 or later. For Debian 11 bullseye, upgrade keystone packages to version 2:18.1.0-1+deb11u2. First update Swift, then update keystone.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-65073

DLA-4367-1

DSA-6056-1

GHSA-HCQG-5G63-7J9H

RHSA-2026:1958

USN-7857-1

USN-7926-1

Affected Products

Linuxmint

Openstack Keystone

Swift

Ubuntu

Keystone

References · 25

• https://cve.org/CVERecord?id=CVE-2025-65073 · Security Note
• https://ubuntu.com/security/CVE-2021-3563 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hcqg-5g63-7j9h · Vendor Advisory
• https://osv.dev/vulnerability/USN-7926-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-65073 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-2447 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7857-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-65073 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7926-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7857-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4367-1 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-6056-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-65073 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65073 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-65073 · Vendor Advisory