Keystone vulnerabilities

2013-10-2300:00:00

ubuntu.com

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

AI Score

Confidence

Low

EPSS

0.005

Percentile

77.1%

JSON

Releases

Ubuntu 13.04
Ubuntu 12.10

Packages

keystone - OpenStack identity service

Details

Chmouel Boudjnah discovered that Keystone did not properly invalidate user
tokens when a tenant was disabled which allowed an authenticated user to
retain access via the token. (CVE-2013-4222)

Kieran Spear discovered that Keystone did not properly verify PKI tokens
when performing revocation when using the memcache and KVS backends. An
authenticated attacker could exploit this to bypass intended access
restrictions. (CVE-2013-4294)

OSVersionArchitecturePackageVersionFilename
Ubuntu13.04noarchpython-keystone< 1:2013.1.3-0ubuntu1.1UNKNOWN
Ubuntu13.04noarchkeystone< 1:2013.1.3-0ubuntu1.1UNKNOWN
Ubuntu13.04noarchkeystone-doc< 1:2013.1.3-0ubuntu1.1UNKNOWN
Ubuntu12.10noarchpython-keystone< 2012.2.4-0ubuntu3.2UNKNOWN
Ubuntu12.10noarchkeystone< 2012.2.4-0ubuntu3.2UNKNOWN
Ubuntu12.10noarchkeystone-doc< 2012.2.4-0ubuntu3.2UNKNOWN

OS	Version	Architecture	Package	Version	Filename
Ubuntu	13.04	noarch	python-keystone	< 1:2013.1.3-0ubuntu1.1	UNKNOWN
Ubuntu	13.04	noarch	keystone	< 1:2013.1.3-0ubuntu1.1	UNKNOWN
Ubuntu	13.04	noarch	keystone-doc	< 1:2013.1.3-0ubuntu1.1	UNKNOWN
Ubuntu	12.10	noarch	python-keystone	< 2012.2.4-0ubuntu3.2	UNKNOWN
Ubuntu	12.10	noarch	keystone	< 2012.2.4-0ubuntu3.2	UNKNOWN
Ubuntu	12.10	noarch	keystone-doc	< 2012.2.4-0ubuntu3.2	UNKNOWN