OpenStack Identity (Keystone) improper revoking of the authentication token when deleting a user

Description

References

• nvd.nist.gov/vuln/detail/CVE-2013-2059 · ADVISORY
• openstack/keystone commit 33214f3 · WEB
• openstack/keystone commit 678b06a · WEB
• openstack/keystone commit 992466d · WEB
• bugs.launchpad.net/keystone/+bug/1166670 · WEB
• exchange.xforce.ibmcloud.com/vulnerabilities/84135 · WEB
• openstack/keystone · PACKAGE
• pypa/advisory-database · WEB
• lists.fedoraproject.org/pipermail/package-announce/2013-May/105916.html · WEB
• lists.fedoraproject.org/pipermail/package-announce/2013-May/106220.html · WEB
• lists.opensuse.org/opensuse-updates/2013-06/msg00085.html · WEB
• openwall.com/lists/oss-security/2013/05/09/3 · WEB
• openwall.com/lists/oss-security/2013/05/09/4 · WEB
• osvdb.org/93134
• secunia.com/advisories/53326 · Vendor Advisory
• secunia.com/advisories/53339 · Vendor Advisory
• securityfocus.com/bid/59787

keystone의 다른 취약점

• CVE-2026-44394높음 8.1An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the origina…
• CVE-2026-43000높음 8.8An issue was discovered in OpenStack Keystone before 29.0.2. When combined with an application credential impersonation vulnerability, an at…
• CVE-2026-42999높음 8.8An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone RBAC policy enforcer in enforce_call unconditionally merges the ra…
• CVE-2026-42998높음 8.8An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that …
• CVE-2026-43001높음 8.0An issue was discovered in OpenStack Keystone before 29.0.2. POST /v3/credentials did not validate that the caller-supplied project_id for a…