p PatchFirst

CVE-2014-2237

CVE-2014-2237

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.

CVSS 6.5 · Medium · EPSS 1.4% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • keystone Debian:12

    Affected ranges
    • ECOSYSTEM: < 2013.2.3-1

    Update to 2013.2.3-1

  • keystone Debian:13

    Affected ranges
    • ECOSYSTEM: < 2013.2.3-1

    Update to 2013.2.3-1

  • keystone Debian:14

    Affected ranges
    • ECOSYSTEM: < 2013.2.3-1

    Update to 2013.2.3-1

  • keystone PyPI

    Affected ranges
    • ECOSYSTEM: < 8.0.0a0

    Update to 8.0.0a0

Original sources

Check your server →