p PatchFirst

CVE-2013-4294

CVE-2013-4294

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.

CVSS 5.3 · Medium · EPSS 2.7% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • keystone Debian:12

    Affected ranges
    • ECOSYSTEM: < 2013.1.3-2

    Update to 2013.1.3-2

  • keystone Debian:13

    Affected ranges
    • ECOSYSTEM: < 2013.1.3-2

    Update to 2013.1.3-2

  • keystone Debian:14

    Affected ranges
    • ECOSYSTEM: < 2013.1.3-2

    Update to 2013.1.3-2

  • keystone PyPI

    Affected ranges
    • ECOSYSTEM: ≥ 2012.2.0, < 2013.1.4

    Update to 2013.1.4

Original sources

Check your server →