CVE-2013-4294
published 2013-09-23CVE-2013-4294: The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token…
PriorityP427medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
2.34%
81.7th percentile
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | keystone | < keystone 2013.1.3-2 (bookworm) | keystone 2013.1.3-2 (bookworm) |
| openstack | keystone | — | — |
| openstack | keystone | — | — |
| openstack | keystone | — | — |
| openstack | keystone | — | — |
| openstack | keystone | — | — |
| openstack | keystone | — | — |
| openstack | keystone | — | — |
| openstack | keystone | — | — |
| openstack | keystone | — | — |
| openstack | keystone | >= 0 < 2013.1.3-2 | 2013.1.3-2 |
| openstack | keystone | >= 0 < 2013.1.3-2 | 2013.1.3-2 |
| openstack | keystone | >= 0 < 2013.1.3-2 | 2013.1.3-2 |
| openstack | keystone | >= 0 < 2013.1.3-2 | 2013.1.3-2 |
| openstack | keystone | >= 2012.2.0 < 2013.1.4 | 2013.1.4 |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_ubuntu6.5MEDIUM
vendor_debian5.0MEDIUM
vendor_redhat5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
OpenStack Identity (Keystone) allows remote attackers to bypass intended access restrictions via revoked PKI token
osv·2022-05-17
CVE-2013-4294 [MEDIUM] OpenStack Identity (Keystone) allows remote attackers to bypass intended access restrictions via revoked PKI token
OpenStack Identity (Keystone) allows remote attackers to bypass intended access restrictions via revoked PKI token
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
GHSA
OpenStack Identity (Keystone) allows remote attackers to bypass intended access restrictions via revoked PKI token
ghsa·2022-05-17
CVE-2013-4294 [MEDIUM] OpenStack Identity (Keystone) allows remote attackers to bypass intended access restrictions via revoked PKI token
OpenStack Identity (Keystone) allows remote attackers to bypass intended access restrictions via revoked PKI token
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
OSV
CVE-2013-4294: The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012
osv·2013-09-23·CVSS 5.0
CVE-2013-4294 [MEDIUM] CVE-2013-4294: The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
Ubuntu
Keystone vulnerabilities
vendor_ubuntu·2013-10-23·CVSS 6.5
CVE-2013-4294 [MEDIUM] Keystone vulnerabilities
Title: Keystone vulnerabilities
Summary: Keystone would improperly grant access to invalid tokens under certain
circumstances.
Chmouel Boudjnah discovered that Keystone did not properly invalidate user
tokens when a tenant was disabled which allowed an authenticated user to
retain access via the token. (CVE-2013-4222)
Kieran Spear discovered that Keystone did not properly verify PKI tokens
when performing revocation when using the memcache and KVS backends. An
authenticated attacker could exploit this to bypass intended access
restrictions. (CVE-2013-4294)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
OpenStack: Keystone Token revocation failure using Keystone memcache/KVS backends
vendor_redhat·2013-09-11·CVSS 5.0
CVE-2013-4294 [MEDIUM] CWE-697 OpenStack: Keystone Token revocation failure using Keystone memcache/KVS backends
OpenStack: Keystone Token revocation failure using Keystone memcache/KVS backends
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
Package: openstack-keystone (Red Hat OpenStack Platform 4) - Affected
Debian
CVE-2013-4294: keystone - The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Fol...
vendor_debian·2013·CVSS 5.0
CVE-2013-4294 [MEDIUM] CVE-2013-4294: keystone - The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Fol...
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
Scope: local
bookworm: resolved (fixed in 2013.1.3-2)
bullseye: resolved (fixed in 2013.1.3-2)
forky: resolved (fixed in 2013.1.3-2)
sid: resolved (fixed in 2013.1.3-2)
trixie: resolved (fixed in 2013.1.3-2)
No detection rules found.
No public exploits indexed.
http://osvdb.org/97237http://rhn.redhat.com/errata/RHSA-2013-1285.htmlhttp://seclists.org/oss-sec/2013/q3/586http://secunia.com/advisories/54706http://www.ubuntu.com/usn/USN-2002-1https://bugs.launchpad.net/keystone/+bug/1202952http://osvdb.org/97237http://rhn.redhat.com/errata/RHSA-2013-1285.htmlhttp://seclists.org/oss-sec/2013/q3/586http://secunia.com/advisories/54706http://www.ubuntu.com/usn/USN-2002-1https://bugs.launchpad.net/keystone/+bug/1202952
2013-09-23
Published