p PatchFirst

CVE-2015-7546

CVE-2015-7546

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers, which allows remote authenticated users to bypass intended access restrictions and gain access to cloud resources by manipulating byte fields within a revoked token.

CVSS 7.5 · High · EPSS 2.0% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • keystone Debian:12

    Affected ranges
    • ECOSYSTEM: < 2:9.0.0~rc2-1

    Update to 2:9.0.0~rc2-1

  • keystone Debian:13

    Affected ranges
    • ECOSYSTEM: < 2:9.0.0~rc2-1

    Update to 2:9.0.0~rc2-1

  • keystone Debian:14

    Affected ranges
    • ECOSYSTEM: < 2:9.0.0~rc2-1

    Update to 2:9.0.0~rc2-1

  • python-keystonemiddleware Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.0.0-1

    Update to 3.0.0-1

  • python-keystonemiddleware Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.0.0-1

    Update to 3.0.0-1

  • python-keystonemiddleware Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.0.0-1

    Update to 3.0.0-1

  • keystone PyPI

    Affected ranges
    • ECOSYSTEM: ≥ 9.0.0.0b1, < 9.0.0.0b2

    Update to 9.0.0.0b2

  • keystonemiddleware PyPI

    Versions
    • 2.4.0
    • 2.4.1
    • 3.0.0
    • 4.0.0
    Affected ranges
    • ECOSYSTEM: ≥ 2.4.0, < 4.1.0

    Update to 4.1.0

  • keystone PyPI

    Affected ranges
    • ECOSYSTEM: ≥ 8.0, < 8.1.0

    Update to 8.1.0

  • keystonemiddleware PyPI

    Versions
    • 0
    • 1.0.0
    • 1.1.0
    • 1.1.1
    • 1.2.0
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 1.5.3
    Affected ranges
    • ECOSYSTEM: < 1.5.4

    Update to 1.5.4

  • keystonemiddleware PyPI

    Versions
    • 1.6.0
    • 1.6.1
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.3.0
    • 2.3.1
    • 2.3.2
    Affected ranges
    • ECOSYSTEM: ≥ 1.6.0, < 2.3.3

    Update to 2.3.3

  • keystonemiddleware PyPI

    Versions
    • 0
    • 1.0.0
    • 1.1.0
    • 1.1.1
    • 1.2.0
    • 1.3.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.5.0
    • 1.5.1
    • 1.5.2
    • 1.5.3
    • 1.6.0
    • 1.6.1
    • 2.0.0
    • 2.1.0
    • 2.2.0
    • 2.3.0
    • 2.3.1
    • 2.3.2
    Affected ranges
    • ECOSYSTEM: < 1.5.4 ∪ ≥ 1.6.0, < 2.3.3

    Update to 1.5.4; Update to 2.3.3

  • keystone PyPI

    Affected ranges
    • ECOSYSTEM: ≥ 8.0, < 8.1.0 ∪ ≥ 9.0.0.0b1, < 9.0.0.0b2

    Update to 8.1.0; Update to 9.0.0.0b2

Original sources

Check your server →