CVE-2014-5253

OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated users to retain access via a domain-scoped token for that domain.

Published: Aug 25, 2014
Updated: Apr 13, 2023
CVE: CVE-2014-5253
Severity: Low
Exploit:

CVSS v2:

Severity: Low
Score: 4.9
AV:N/AC:M/Au:S/C:P/I:P/A:N

CWEs:

CWE-255

Affected Software
References

Software	From	Fixed in
openstack / keystone	juno-2	juno-2.x
openstack / keystone	2014.1.2	2014.1.2.x
canonical / ubuntu_linux	14.04	14.04.x
openstack / keystone	2014.1	2014.1.x
openstack / keystone	juno-1	juno-1.x

http://rhn.redhat.com/errata/RHSA-2014-1121.html
http://rhn.redhat.com/errata/RHSA-2014-1122.html
http://www.openwall.com/lists/oss-security/2014/08/15/6
http://www.ubuntu.com/usn/USN-2324-1
https://bugs.launchpad.net/keystone/+bug/1349597

Vulnerability Database

CVE-2014-5253

Deep Security Visibility Without the Complexity