CVE-2013-4222
First published: Mon Sep 30 2013(Updated: )
OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenStack keystonemiddleware | >=2013.1<=2013.1.3 | |
| Fedora | =20 | |
| Ubuntu | =12.10 | |
| Ubuntu | =13.04 | |
| Red Hat OpenStack for IBM Power | =3.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2013-4222?
CVE-2013-4222 is considered a high-severity vulnerability due to its impact on authentication and access control.
How do I fix CVE-2013-4222?
To fix CVE-2013-4222, you should upgrade OpenStack Identity (Keystone) to version 2013.1.4 or later.
Which versions of OpenStack are affected by CVE-2013-4222?
CVE-2013-4222 affects OpenStack Identity (Keystone) versions 2013.1.3 and earlier.
What are the consequences of CVE-2013-4222?
CVE-2013-4222 can allow remote authenticated users to retain access to resources even after their tenant has been disabled.
Is there a workaround for CVE-2013-4222?
There is no official workaround for CVE-2013-4222; upgrading is the recommended approach.
- agent/references
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/author
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/openstack
- canonical/openstack keystonemiddleware
- version/openstack keystonemiddleware/2013.1
- version/openstack keystonemiddleware/2013.1.3
- vendor/fedoraproject
- canonical/fedora
- version/fedora/20
- vendor/canonical
- canonical/ubuntu
- version/ubuntu/12.10
- version/ubuntu/13.04
- vendor/redhat
- canonical/red hat openstack for ibm power
- version/red hat openstack for ibm power/3.0