CVE-2013-1865: OpenStack Keystone Improper Authentication… – CVSS 6.8 · Watchpost

← All vulnerabilities

OpenStack Keystone Improper Authentication vulnerability

MOYENNE 6.8CVE-2013-1865 · GHSA-22q6-wwq7-2jj9 · PYSEC-2013-39 · Published 22/03/2013 · updated 16/06/2026

En bref

CVE-2013-1865 est une vulnérabilité MOYENNE (CVSS 6.8) touchant keystone, folsom (openstack).
Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 2.6%, plus élevée que 85.5% des vulnérabilités.
Correctif : mettre à jour vers 2012.2.4 ou plus récent.

Package	Affected versions	Patched versions
keystone PyPI	`≥ 2012.2, < 2012.2.4`	`2012.2.4`
folsom openstack	`= 2012.2`	No fix yet

Description

OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token.

NVD description

OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token.

References

nvd.nist.gov/vuln/detail/CVE-2013-1865 · ADVISORY
access.redhat.com/errata/RHSA-2013:0708 · WEB
access.redhat.com/security/cve/CVE-2013-1865 · WEB
bugs.launchpad.net/keystone/+bug/1129713 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
pypa/advisory-database · WEB
opendev.org/openstack/keystone · PACKAGE
review.openstack.org · WEB
review.openstack.org/24906 · WEB
web.archive.org/web/20170715155558/http://www.securityfocus.com/bid/58616 · WEB
openstack/keystone commit 255b1d4 · WEB
lists.fedoraproject.org/pipermail/package-announce/2013-April/101719.html

Autres vulnérabilités de keystone

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free