CVE-2014-5252: Medium severity keystone vulnerability
The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issuedat value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-5252?
CVE-2014-5252 is considered to have a high severity due to its potential to allow unauthorized access via token bypass.
How do I fix CVE-2014-5252?
To fix CVE-2014-5252, upgrade OpenStack Keystone to version 2014.1.2.1 or later, or to the version specified in the remedy.
Which versions of OpenStack Keystone are affected by CVE-2014-5252?
CVE-2014-5252 affects OpenStack Keystone versions 2014.1.x before 2014.1.2.1 and Juno versions before Juno-3.
Who can exploit CVE-2014-5252?
CVE-2014-5252 can be exploited by remote authenticated users who can perform GET or HEAD requests.
What impact does CVE-2014-5252 have on token security?
CVE-2014-5252 allows attackers to bypass token expiration, potentially maintaining unauthorized access to resources.