CVE-2014-5251: OpenStack Identity (Keystone) Multiple… – CVSS 4.9 · Watchpost

← All vulnerabilities

OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events

보통 4.9CVE-2014-5251 · GHSA-gmvp-5rf9-mxcm · PYSEC-2014-107 · Published 25/08/2014 · updated 17/06/2026

요약

CVE-2014-5251은(는) keystone, keystone (openstack)에 영향을 주는 보통 (CVSS 4.9) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 1.6%, 전체 취약점의 75.7%보다 높음.
조치: 8.0.0a0 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
keystone PyPI	`< 8.0.0a0`	`8.0.0a0`
keystone openstack	`= 2014.1= 2014.1.2= juno-1= juno-2`	No fix yet

Description

The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token.

NVD description

The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token.

References

nvd.nist.gov/vuln/detail/CVE-2014-5251 · ADVISORY
openstack/keystone commit 6cbf835 · WEB
openstack/keystone commit 7aee630 · WEB
bugs.launchpad.net/keystone/+bug/1347961 · WEB
openstack/keystone · PACKAGE
pypa/advisory-database · WEB
rhn.redhat.com/errata/RHSA-2014-1121.html · WEB
rhn.redhat.com/errata/RHSA-2014-1122.html · WEB
openwall.com/lists/oss-security/2014/08/15/6 · WEB
ubuntu.com/usn/USN-2324-1 · WEB

keystone의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free