CVE-2013-4294

Published Sep 23, 2013

Last updated 2 years ago

Overview

Description: The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
Source: secalert@redhat.com
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 5
Impact score: 2.9
Exploitability score: 10
Vector string: AV:N/AC:L/Au:N/C:N/I:P/A:N

Weaknesses

nvd@nist.gov: CWE-264

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:openstack:keystone:2012.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "22E8C9F6-6DEE-4DD1-9B3E-5879E51464B9"
          },
          {
            "criteria": "cpe:2.3:a:openstack:keystone:2012.2.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4C26C7AF-F31B-48B4-8FA0-FBA24E86D641"
          },
          {
            "criteria": "cpe:2.3:a:openstack:keystone:2012.2.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "792412B1-891F-404E-BC7F-1FA1DF4A623B"
          },
          {
            "criteria": "cpe:2.3:a:openstack:keystone:2012.2.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4481B437-5602-4EC9-BAD2-7EF065448E69"
          },
          {
            "criteria": "cpe:2.3:a:openstack:keystone:2012.2.4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3A5845BE-3B3F-4015-872A-C4D2771736F0"
          },
          {
            "criteria": "cpe:2.3:a:openstack:keystone:2013.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "70697FA3-5C64-4632-B0F5-7DF12B4B7067"
          },
          {
            "criteria": "cpe:2.3:a:openstack:keystone:2013.1.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F72F13BC-BE73-4DCD-8C7F-7D803CB047FF"
          },
          {
            "criteria": "cpe:2.3:a:openstack:keystone:2013.1.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BFF04D50-069F-493B-8667-C55EA6413AD3"
          },
          {
            "criteria": "cpe:2.3:a:openstack:keystone:2013.1.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0911BBF3-6111-4ED8-B269-EB4383C5DC05"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References