CVE-2014-3520: Medium severity keystone vulnerability

Q: What is the severity of CVE-2014-3520?

CVE-2014-3520 is classified as a moderate severity vulnerability.

Q: How do I fix CVE-2014-3520?

To fix CVE-2014-3520, upgrade OpenStack Keystone to version 2013.2.4 or 2014.1.2 and later.

Q: Who is affected by CVE-2014-3520?

CVE-2014-3520 affects remote authenticated users of OpenStack Identity (Keystone) versions prior to 2013.2.4 and 2014.1.2.

Q: What types of attacks can CVE-2014-3520 facilitate?

CVE-2014-3520 can potentially allow unauthorized access to projects via the misuse of trust tokens.

Q: What is the impact of CVE-2014-3520 on OpenStack installations?

CVE-2014-3520 can lead to data exposure and unauthorized actions in projects for which the trustor has roles.

Published Oct 26, 2014

Updated

OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the project ID in a V2 API trust token request.

Affected Software

2 affected components

Openstack Keystone>=2013.2<2013.2.4

Openstack Keystone>=2014.1<2014.1.2

Remediation

Patch Available

http://lists.openstack.org/pipermail/openstack-announce/2014-July/000248.html

Event History

Oct 26, 2014

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3520?

CVE-2014-3520 is classified as a moderate severity vulnerability.

How do I fix CVE-2014-3520?

To fix CVE-2014-3520, upgrade OpenStack Keystone to version 2013.2.4 or 2014.1.2 and later.

Who is affected by CVE-2014-3520?