OpenStack Keystone Improper Authentication vulnerability

中危 6.8CVE-2013-1865 · GHSA-22q6-wwq7-2jj9 · PYSEC-2013-39 · Published 22/03/2013 · updated 16/06/2026

要点

CVE-2013-1865 是影响 keystone, folsom (openstack) 的中危 (CVSS 6.8)漏洞。
未来 30 天内被利用的概率（EPSS）：2.6%，高于 85.5% 的漏洞。
修复：升级到 2012.2.4 或更高版本。

Package	Affected versions	Patched versions
keystone PyPI	`≥ 2012.2, < 2012.2.4`	`2012.2.4`
folsom openstack	`= 2012.2`	No fix yet

Description

OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2013-1865 · ADVISORY
access.redhat.com/errata/RHSA-2013:0708 · WEB
access.redhat.com/security/cve/CVE-2013-1865 · WEB
bugs.launchpad.net/keystone/+bug/1129713 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
pypa/advisory-database · WEB
opendev.org/openstack/keystone · PACKAGE
review.openstack.org · WEB
review.openstack.org/24906 · WEB
web.archive.org/web/20170715155558/http://www.securityfocus.com/bid/58616 · WEB
openstack/keystone commit 255b1d4 · WEB
lists.fedoraproject.org/pipermail/package-announce/2013-April/101719.html

keystone 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

keystone

PyPI

≥ 2012.2, < 2012.2.4

2012.2.4

folsom

openstack

= 2012.2

No fix yet

Description

NVD description

keystone 的其他漏洞

查看全部 →