CVE-2013-1865: Medium severity red hat openstack folsom vulnerability
OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token.
Other sources
Thierry Carrez (thierry) reports:
Title: Online validation of Keystone PKI tokens bypasses revocation check Reporter: Guang Yee (HP) Products: Keystone Affects: Folsom
Description: Guang Yee from HP reported a vulnerability in the revocation check for Keystone PKI tokens. Those tokens are supposed to be validated locally using cryptographic checks, but the user also has the option of asking the server to validate them. In that case, the online verification of PKI tokens would bypass the revocation check, potentially affirming revocated tokens are still valid. Only setups making use of online verification of PKI tokens are affected.
Proposed patches: See attached patch. Unless a flaw is discovered in it, this patch will be merged to Keystone stable/folsom branch on the public disclosure date.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1865?
CVE-2013-1865 is classified as a moderate severity vulnerability.
How do I fix CVE-2013-1865?
You can fix CVE-2013-1865 by upgrading to Keystone version 2012.2.4 or later.
What software is affected by CVE-2013-1865?
CVE-2013-1865 affects OpenStack Keystone Folsom (2012.2) and related packages.
Can CVE-2013-1865 be exploited remotely?
Yes, CVE-2013-1865 can be exploited remotely by attackers using revoked PKI tokens.
What type of vulnerability is CVE-2013-1865?
CVE-2013-1865 is an access control vulnerability related to token revocation checks.