CVE-2013-4294
First published: Mon Sep 23 2013(Updated: )
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| OpenStack Keystone | =2012.2 | |
| OpenStack Keystone | =2012.2.1 | |
| OpenStack Keystone | =2012.2.2 | |
| OpenStack Keystone | =2012.2.3 | |
| OpenStack Keystone | =2012.2.4 | |
| OpenStack Keystone | =2013.1 | |
| OpenStack Keystone | =2013.1.1 | |
| OpenStack Keystone | =2013.1.2 | |
| OpenStack Keystone | =2013.1.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/type
- agent/event
- agent/description
- agent/last-modified-date
- agent/softwarecombine
- agent/remedy
- agent/tags
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- vendor/openstack
- canonical/openstack keystone
- version/openstack keystone/2012.2
- version/openstack keystone/2012.2.1
- version/openstack keystone/2012.2.2
- version/openstack keystone/2012.2.3
- version/openstack keystone/2012.2.4
- version/openstack keystone/2013.1
- version/openstack keystone/2013.1.1
- version/openstack keystone/2013.1.2
- version/openstack keystone/2013.1.3