OpenStack Identity Keystone Improper Access Control

MEDIUM 4.3CVE-2016-4911 · GHSA-f82m-w3p3-cgp3 · PYSEC-2016-38 · Published 13/06/2016 · updated 17/06/2026

Package	Affected versions	Patched versions
keystone PyPI	`≥ 9.0.0, < 9.0.1`	`9.0.1`
openstack identity keystone	`= 9.0.0.0`	No fix yet

Description

The Fernet Token Provider in OpenStack Identity (Keystone) 9.0.x before 9.0.1 (mitaka) allows remote authenticated users to prevent revocation of a chain of tokens and bypass intended access restrictions by rescoping a token.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2016-4911 · ADVISORY
openstack/keystone commit 0d37602 · WEB
openstack/keystone commit ee1dc94 · WEB
bugs.launchpad.net/keystone/+bug/1577558 · WEB
openstack/keystone · PACKAGE
pypa/advisory-database · WEB
review.openstack.org · WEB
security.openstack.org/ossa/OSSA-2016-008.html · WEB
openwall.com/lists/oss-security/2016/05/17/10 · WEB
openwall.com/lists/oss-security/2016/05/17/11 · WEB
securityfocus.com/bid/90728 · Third Party Advisory
review.openstack.org · Vendor Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free