CVE-2013-2059: OpenStack Identity (Keystone) improper… – CVSS 6.0 · Watchpost

← All vulnerabilities

OpenStack Identity (Keystone) improper revoking of the authentication token when deleting a user

MEDIO 6.0CVE-2013-2059 · GHSA-hj89-qmx9-8qmh · PYSEC-2013-41 · Published 21/05/2013 · updated 16/06/2026

In breve

CVE-2013-2059 è una vulnerabilità MEDIO (CVSS 6.0) che riguarda keystone, keystone (openstack).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 2.5%, superiore al 84.5% delle vulnerabilità.
Correzione: aggiornare a 8.0.0a0 o successiva.

Package	Affected versions	Patched versions
keystone PyPI	`< 8.0.0a0`	`8.0.0a0`
keystone openstack	`= 2012.1= 2013.1`	No fix yet

Description

OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows remote authenticated users to retain access via the token.

NVD description

OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows remote authenticated users to retain access via the token.

References

nvd.nist.gov/vuln/detail/CVE-2013-2059 · ADVISORY
openstack/keystone commit 33214f3 · WEB
openstack/keystone commit 678b06a · WEB
openstack/keystone commit 992466d · WEB
bugs.launchpad.net/keystone/+bug/1166670 · WEB
exchange.xforce.ibmcloud.com/vulnerabilities/84135 · WEB
openstack/keystone · PACKAGE
pypa/advisory-database · WEB
lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html · WEB
lists.fedoraproject.org/pipermail/package-announce/2013-May/106220.html · WEB
lists.opensuse.org/opensuse-updates/2013-06/msg00085.html

Altre vulnerabilità di keystone

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free