CVE-2013-4294: Medium severity keystone vulnerability
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
Other sources
Thierry Carrez reports:
Title: Token revocation failure using Keystone memcache/KVS backends Reporter: Kieran Spear (University of Melbourne) Products: Keystone Affects: Folsom, Grizzly
Description: Kieran Spear from the University of Melbourne reported a vulnerability in Keystone memcache and KVS token backends. The PKI token revocation lists stored the entire token instead of the token ID, triggering comparison failures, ultimately resulting in revoked PKI tokens still being considered valid. Only Folsom and Grizzly Keystone setups making use of PKI tokens with the memcache or KVS token backends are affected. Havana setups, setups using UUID tokens, or setups using PKI tokens with the SQL token backend are all unaffected.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4294?
CVE-2013-4294 is considered a critical vulnerability as it allows remote attackers to bypass access restrictions using revoked PKI tokens.
How do I fix CVE-2013-4294?
To fix CVE-2013-4294, upgrade your OpenStack Keystone to version 2013.1.4 or later.
Which versions of OpenStack Keystone are affected by CVE-2013-4294?
CVE-2013-4294 affects OpenStack Keystone versions 2012.2.x up to 2012.2.4 and 2013.1 up to 2013.1.3.
What type of attack is enabled by CVE-2013-4294?
CVE-2013-4294 enables an attacker to bypass intended access restrictions using revoked PKI tokens.
Is CVE-2013-4294 related to token revocation in OpenStack?
Yes, CVE-2013-4294 relates to improper handling of PKI token revocation in OpenStack Identity (Keystone).