TI-2013-03926 Aliases CVE-2013-4477 GHSA-f889-wfwm-6p7m

The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a…

LOW 16CWE-264Published 2013-11-02 · Updated 2024-08-06

Key facts

Attack vector: Local
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: Security bypass
Confidentiality · integrity · availability: Partial · Partial · None
Fix status: Partial Red Hat: 1 fixed, 1 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-264.

Summary

The LDAP backend in OpenStack Identity (Keystone) Grizzly and Havana, when removing a role on a tenant for a user who does not have that role, adds the role to the user, which allows local users to gain privileges.

Why it matters now

EPSS 0.00447 39th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Partial keystone (PyPI): 8.0.0a0Red Hat: 1 advisoryRed Hat: 1 fixed, 1 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	keystone (PyPI)	before 8.0.0a0	8.0.0a0	Patch available	GHSA-f889-wfwm-6p7m

— Vendor— Affected all versions Fixed in — No fix listed CNA
keystone (PyPI) Vendor— Affected before 8.0.0a0 Fixed in 8.0.0a0 Patch available GHSA-f889-wfwm-6p7m

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:openstack:grizzly:-:::::::*	not specified by NVD	Vulnerable	OpenStack
cpe:2.3:a:openstack:havana:-:::::::*	not specified by NVD	Vulnerable	OpenStack

cpe:2.3:a:openstack:grizzly:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·OpenStack
cpe:2.3:a:openstack:havana:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·OpenStack

Remediation

Fix · GHSA-f889-wfwm-6p7m keystone (PyPI) Fixed in 8.0.0a0 Advisory →

Red Hat 1 advisory

RHSA-2014:0113 Released 2014-01-30 · Red Hat rating Moderate
openstack-keystone security update
- Red Hat Enterprise Linux OpenStack Platform 3.0 openstack-keystone-2013.1.4-2.el6ost, openstack-keystone-doc-2013.1.4-2.el6ost, python-keystone-2013.1.4-2.el6ost

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenStack Platform 4	Affected	No fix yet
Red Hat Enterprise Linux OpenStack Platform 3.0	Fixed	RHSA-2014:0113

Timeline

2026-10-02 Threatist record created from CVE-2013-4477
2026-10-03 Alias added: GHSA-f889-wfwm-6p7m

References

Exploit 1

https://bugs.launchpad.net/keystone/+bug/1242855

Patch 1

[oss-security] 20131030 [OSSA 2013-028] Unintentional role granting with Keystone LDAP backend (CVE-2013-4477)

Advisory 3

Other 3

TI-2013-01930 XML injection vulnerability in account/utils.py in OpenStack Swift Folsom, Grizzly, and… CVSS 2.0HIGH 7.5
TI-2013-00265 Openstack nova: vnc proxy can connect to the wrong vm CVSS 3.1HIGH 7.6
TI-2013-05849 The i_create_images_and_backing (aka create_images_and_backing) method in libvirt driver… CVSS 2.0HIGH 7.1
TI-2013-03945 The XenAPI backend in OpenStack Compute (Nova) Folsom, Grizzly, and Havana before 2013.2… CVSS 2.0MEDIUM 6.4
TI-2012-04728 Openstack nova: information leak in libvirt lvm-backed instances CVSS 3.1MEDIUM 6.5
TI-2013-01461 The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack… CVSS 2.0MEDIUM 5.0

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences