Red Hat Security Advisory

RHSA-2014:1122

openstack-keystone security and bug fix update

Released 2014-09-02 · Red Hat rating Low · View on Red Hat →

Fixed in

Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 openstack-keystone-2014.1.2.1-2.el6ost, openstack-keystone-doc-2014.1.2.1-2.el6ost, python-keystone-2014.1.2.1-2.el6ost

Fixes 3 records

TI-2014-04287 CVE-2014-5252 · GHSA-v8fq-gq9j-3v7h

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before…

LOW 26

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and ret…

CVSS 2.0MEDIUM 4.9 Network Low privileges Interaction — EPSS 0.01515 Published 2014-08-25 Fixed in 8.0.0a0 CWE-255

TI-2014-04286 CVE-2014-5251 · GHSA-gmvp-5rf9-mxcm

The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and…

LOW 26

The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allo…

CVSS 2.0MEDIUM 4.9 Network Low privileges Interaction — EPSS 0.01592 Published 2014-08-25 Fixed in 8.0.0a0 CWE-255

TI-2014-04288 CVE-2014-5253 · GHSA-77w8-qv8m-386h

OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not…

LOW 25

OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated users to retain access via a domain-scoped t…

CVSS 2.0MEDIUM 4.9 Network Low privileges Interaction — EPSS 0.01488 Published 2014-08-25 Fixed in 8.0.0a0 CWE-255