CVE-2014-5252: OpenStack Identity (Keystone) UUID v2… – CVSS 4.9 · Watchpost

← All vulnerabilities

OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events

中危 4.9CVE-2014-5252 · GHSA-v8fq-gq9j-3v7h · PYSEC-2014-108 · Published 25/08/2014 · updated 17/06/2026

要点

CVE-2014-5252 是影响 keystone, keystone (openstack) 的中危 (CVSS 4.9)漏洞。
未来 30 天内被利用的概率（EPSS）：1.5%，高于 74.5% 的漏洞。
修复：升级到 8.0.0a0 或更高版本。

Package	Affected versions	Patched versions
keystone PyPI	`< 8.0.0a0`	`8.0.0a0`
keystone openstack	`= 2014.1= 2014.1.2= juno-1= juno-2`	No fix yet

Description

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.

NVD description

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.

References

nvd.nist.gov/vuln/detail/CVE-2014-5252 · ADVISORY
openstack/keystone commit 556fb86 · WEB
openstack/keystone commit a4c73e4 · WEB
openstack/keystone commit bdb88c6 · WEB
bugs.launchpad.net/keystone/+bug/1348820 · WEB
openstack/keystone · PACKAGE
pypa/advisory-database · WEB
rhn.redhat.com/errata/RHSA-2014-1121.html · WEB
rhn.redhat.com/errata/RHSA-2014-1122.html · WEB
openwall.com/lists/oss-security/2014/08/15/6 · WEB
ubuntu.com/usn/USN-2324-1 · WEB

keystone 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free