OpenStack Identity (Keystone) allows remote attackers to bypass intended access restrictions via revoked PKI token

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2013-4294 · ADVISORY
• access.redhat.com/errata/RHSA-2013:1285 · WEB
• access.redhat.com/security/cve/CVE-2013-4294 · WEB
• bugs.launchpad.net/keystone/+bug/1202952 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• pypa/advisory-database · WEB
• opendev.org/openstack/keystone · PACKAGE
• rhn.redhat.com/errata/RHSA-2013-1285.html · WEB
• seclists.org/oss-sec/2013/q3/586 · WEB
• ubuntu.com/usn/USN-2002-1 · WEB
• osvdb.org/97237
• secunia.com/advisories/54706

keystone のその他の脆弱性

• CVE-2026-44394高 8.1An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the origina…
• CVE-2026-43000高 8.8An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an at…
• CVE-2026-42999高 8.8An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the ra…
• CVE-2026-42998高 8.8An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that …
• CVE-2026-43001高 8.0An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for a…