CVE-2015-7546: High severity openstack keystonemiddleware vulnerability
The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers, which allows remote authenticated users to bypass intended access restrictions and gain access to cloud resources by manipulating byte fields within a revoked token.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7546?
CVE-2015-7546 is considered to have a medium severity risk due to improper token invalidation.
How do I fix CVE-2015-7546?
To fix CVE-2015-7546, upgrade keystonemiddleware to version 1.5.4 or later, or upgrade Keystone to version 8.0.2 or later.
What are the affected versions for CVE-2015-7546?
Affected versions for CVE-2015-7546 include OpenStack Identity (Keystone) prior to 2015.1.3 and keystonemiddleware before 1.5.4.
Who is affected by CVE-2015-7546?
Users of OpenStack Identity and keystonemiddleware on vulnerable versions are affected by CVE-2015-7546.
What is the impact of CVE-2015-7546?
CVE-2015-7546 potentially allows attackers to misuse authorization tokens, leading to unauthorized actions.