python-keystoneclient missing expiration check in PKI token validation

2022-05-1704:54:13

Google

osv.dev

0.002 Low

EPSS

Percentile

64.8%

JSON

python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remote authenticated users to (1) retain use of a token after it has expired, or (2) use a revoked token once it expires.

CPENameOperatorVersion
python-keystoneclienteq0.1.2
python-keystoneclienteq0.2.2
python-keystoneclienteq0.1.1
python-keystoneclienteq0.1.3
python-keystoneclienteq0.2.3
python-keystoneclienteq0.2.1
python-keystoneclienteq0.2.0

Name	Operator	Version
python-keystoneclient	eq	0.1.2
python-keystoneclient	eq	0.2.2
python-keystoneclient	eq	0.1.1
python-keystoneclient	eq	0.1.3
python-keystoneclient	eq	0.2.3
python-keystoneclient	eq	0.2.1
python-keystoneclient	eq	0.2.0