Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2013-6391 (GCVE-0-2013-6391)
Vulnerability from cvelistv5 – Published: 2013-12-14 17:00 – Updated: 2024-08-06 17:39
VLAI
EPSS
Summary
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
8 references
| URL | Tags |
|---|---|
| http://www.ubuntu.com/usn/USN-2061-1 | vendor-advisoryx_refsource_UBUNTU |
| http://www.securityfocus.com/bid/64253 | vdb-entryx_refsource_BID |
| http://www.openwall.com/lists/oss-security/2013/12/11/7 | mailing-listx_refsource_MLIST |
| http://secunia.com/advisories/56154 | third-party-advisoryx_refsource_SECUNIA |
| http://secunia.com/advisories/56079 | third-party-advisoryx_refsource_SECUNIA |
| http://rhn.redhat.com/errata/RHSA-2014-0089.html | vendor-advisoryx_refsource_REDHAT |
| https://bugs.launchpad.net/keystone/+bug/1242597 | x_refsource_CONFIRM |
| https://exchange.xforce.ibmcloud.com/vulnerabilit… | vdb-entryx_refsource_XF |
Date Public
2013-12-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T17:39:01.159Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "USN-2061-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-2061-1"
},
{
"name": "64253",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/64253"
},
{
"name": "[oss-security] 20131211 [OSSA 2013-032] Keystone trust circumvention through EC2-style tokens (CVE-2013-6391)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/12/11/7"
},
{
"name": "56154",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/56154"
},
{
"name": "56079",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/56079"
},
{
"name": "RHSA-2014:0089",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0089.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugs.launchpad.net/keystone/+bug/1242597"
},
{
"name": "keystone-cve20136391-sec-bypass(89657)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89657"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-12-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-08-28T12:57:01.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "USN-2061-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-2061-1"
},
{
"name": "64253",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/64253"
},
{
"name": "[oss-security] 20131211 [OSSA 2013-032] Keystone trust circumvention through EC2-style tokens (CVE-2013-6391)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/12/11/7"
},
{
"name": "56154",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/56154"
},
{
"name": "56079",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/56079"
},
{
"name": "RHSA-2014:0089",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0089.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugs.launchpad.net/keystone/+bug/1242597"
},
{
"name": "keystone-cve20136391-sec-bypass(89657)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89657"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-6391",
"datePublished": "2013-12-14T17:00:00.000Z",
"dateReserved": "2013-11-04T00:00:00.000Z",
"dateUpdated": "2024-08-06T17:39:01.159Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2013-6391",
"date": "2026-06-04",
"epss": "0.00498",
"percentile": "0.6621"
},
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"2013.2\", \"versionEndExcluding\": \"2013.2.1\", \"matchCriteriaId\": \"7B680778-01B9-4BD1-BBC6-0D6EC736E71B\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F61F047-129C-41A6-8A27-FFCBB8563E91\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1802FDB8-C919-4D5E-A8AD-4C5B72525090\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.\"}, {\"lang\": \"es\", \"value\": \"La API ec2tokens en OpenStack Identity (Keystone) anterior a de Havana 2013.2.1 y Icehouse anterior Icehouse-2 no devuelve una token de confianza de \\u00e1mbito cuando se recibe uno, lo que permite a los usuarios la confianza remotos obtener privilegios mediante la generaci\\u00f3n de credenciales EC2 a partir de un token de confianza de \\u00e1mbito y us\\u00e1ndolo una solicitud API ec2tokens\"}]",
"id": "CVE-2013-6391",
"lastModified": "2024-11-21T01:59:08.070",
"metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:P/I:P/A:N\", \"baseScore\": 5.8, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 4.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2013-12-14T17:21:46.663",
"references": "[{\"url\": \"http://rhn.redhat.com/errata/RHSA-2014-0089.html\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://secunia.com/advisories/56079\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://secunia.com/advisories/56154\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2013/12/11/7\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/64253\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.ubuntu.com/usn/USN-2061-1\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://bugs.launchpad.net/keystone/+bug/1242597\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Exploit\", \"Issue Tracking\", \"Third Party Advisory\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/89657\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2014-0089.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://secunia.com/advisories/56079\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://secunia.com/advisories/56154\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2013/12/11/7\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/64253\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"http://www.ubuntu.com/usn/USN-2061-1\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://bugs.launchpad.net/keystone/+bug/1242597\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Issue Tracking\", \"Third Party Advisory\"]}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/89657\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"VDB Entry\"]}]",
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-269\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2013-6391\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2013-12-14T17:21:46.663\",\"lastModified\":\"2026-04-29T01:13:23.040\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.\"},{\"lang\":\"es\",\"value\":\"La API ec2tokens en OpenStack Identity (Keystone) anterior a de Havana 2013.2.1 y Icehouse anterior Icehouse-2 no devuelve una token de confianza de \u00e1mbito cuando se recibe uno, lo que permite a los usuarios la confianza remotos obtener privilegios mediante la generaci\u00f3n de credenciales EC2 a partir de un token de confianza de \u00e1mbito y us\u00e1ndolo una solicitud API ec2tokens\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:N\",\"baseScore\":5.8,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":4.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-269\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2013.2\",\"versionEndExcluding\":\"2013.2.1\",\"matchCriteriaId\":\"7B680778-01B9-4BD1-BBC6-0D6EC736E71B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F61F047-129C-41A6-8A27-FFCBB8563E91\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1802FDB8-C919-4D5E-A8AD-4C5B72525090\"}]}]}],\"references\":[{\"url\":\"http://rhn.redhat.com/errata/RHSA-2014-0089.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/56079\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/56154\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2013/12/11/7\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/64253\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-2061-1\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugs.launchpad.net/keystone/+bug/1242597\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/89657\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2014-0089.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/56079\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/56154\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2013/12/11/7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/64253\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-2061-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugs.launchpad.net/keystone/+bug/1242597\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/89657\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"VDB Entry\"]}]}}"
}
}
FKIE_CVE-2013-6391
Vulnerability from fkie_nvd - Published: 2013-12-14 17:21 - Updated: 2026-04-29 01:13
Severity
Summary
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
References
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7B680778-01B9-4BD1-BBC6-0D6EC736E71B",
"versionEndExcluding": "2013.2.1",
"versionStartIncluding": "2013.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*",
"matchCriteriaId": "7F61F047-129C-41A6-8A27-FFCBB8563E91",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1802FDB8-C919-4D5E-A8AD-4C5B72525090",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request."
},
{
"lang": "es",
"value": "La API ec2tokens en OpenStack Identity (Keystone) anterior a de Havana 2013.2.1 y Icehouse anterior Icehouse-2 no devuelve una token de confianza de \u00e1mbito cuando se recibe uno, lo que permite a los usuarios la confianza remotos obtener privilegios mediante la generaci\u00f3n de credenciales EC2 a partir de un token de confianza de \u00e1mbito y us\u00e1ndolo una solicitud API ec2tokens"
}
],
"id": "CVE-2013-6391",
"lastModified": "2026-04-29T01:13:23.040",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-12-14T17:21:46.663",
"references": [
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0089.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/56079"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/56154"
},
{
"source": "secalert@redhat.com",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2013/12/11/7"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/64253"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-2061-1"
},
{
"source": "secalert@redhat.com",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugs.launchpad.net/keystone/+bug/1242597"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89657"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0089.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/56079"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/56154"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2013/12/11/7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/64253"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-2061-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugs.launchpad.net/keystone/+bug/1242597"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89657"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-269"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
GHSA-3FPM-8W39-5P69
Vulnerability from github – Published: 2022-05-13 01:26 – Updated: 2022-05-13 01:26
VLAI
Details
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
{
"affected": [],
"aliases": [
"CVE-2013-6391"
],
"database_specific": {
"cwe_ids": [
"CWE-269"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2013-12-14T17:21:00Z",
"severity": "MODERATE"
},
"details": "The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.",
"id": "GHSA-3fpm-8w39-5p69",
"modified": "2022-05-13T01:26:09Z",
"published": "2022-05-13T01:26:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6391"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/keystone/+bug/1242597"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89657"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0089.html"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/56079"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/56154"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/12/11/7"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/64253"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-2061-1"
}
],
"schema_version": "1.4.0",
"severity": []
}
GSD-2013-6391
Vulnerability from gsd - Updated: 2023-12-13 01:22Details
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2013-6391",
"description": "The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.",
"id": "GSD-2013-6391",
"references": [
"https://www.suse.com/security/cve/CVE-2013-6391.html",
"https://access.redhat.com/errata/RHSA-2014:0368",
"https://access.redhat.com/errata/RHSA-2014:0089"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2013-6391"
],
"details": "The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.",
"id": "GSD-2013-6391",
"modified": "2023-12-13T01:22:19.147067Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-6391",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://rhn.redhat.com/errata/RHSA-2014-0089.html",
"refsource": "MISC",
"url": "http://rhn.redhat.com/errata/RHSA-2014-0089.html"
},
{
"name": "http://secunia.com/advisories/56079",
"refsource": "MISC",
"url": "http://secunia.com/advisories/56079"
},
{
"name": "http://secunia.com/advisories/56154",
"refsource": "MISC",
"url": "http://secunia.com/advisories/56154"
},
{
"name": "http://www.openwall.com/lists/oss-security/2013/12/11/7",
"refsource": "MISC",
"url": "http://www.openwall.com/lists/oss-security/2013/12/11/7"
},
{
"name": "http://www.securityfocus.com/bid/64253",
"refsource": "MISC",
"url": "http://www.securityfocus.com/bid/64253"
},
{
"name": "http://www.ubuntu.com/usn/USN-2061-1",
"refsource": "MISC",
"url": "http://www.ubuntu.com/usn/USN-2061-1"
},
{
"name": "https://bugs.launchpad.net/keystone/+bug/1242597",
"refsource": "MISC",
"url": "https://bugs.launchpad.net/keystone/+bug/1242597"
},
{
"name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89657",
"refsource": "MISC",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89657"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:openstack:keystone:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "2013.2.1",
"versionStartIncluding": "2013.2",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:redhat:openstack:4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-6391"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-269"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "56079",
"refsource": "SECUNIA",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/56079"
},
{
"name": "https://bugs.launchpad.net/keystone/+bug/1242597",
"refsource": "CONFIRM",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://bugs.launchpad.net/keystone/+bug/1242597"
},
{
"name": "64253",
"refsource": "BID",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/64253"
},
{
"name": "[oss-security] 20131211 [OSSA 2013-032] Keystone trust circumvention through EC2-style tokens (CVE-2013-6391)",
"refsource": "MLIST",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2013/12/11/7"
},
{
"name": "USN-2061-1",
"refsource": "UBUNTU",
"tags": [
"Third Party Advisory"
],
"url": "http://www.ubuntu.com/usn/USN-2061-1"
},
{
"name": "56154",
"refsource": "SECUNIA",
"tags": [
"Third Party Advisory"
],
"url": "http://secunia.com/advisories/56154"
},
{
"name": "RHSA-2014:0089",
"refsource": "REDHAT",
"tags": [
"Third Party Advisory"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-0089.html"
},
{
"name": "keystone-cve20136391-sec-bypass(89657)",
"refsource": "XF",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/89657"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2020-06-02T19:54Z",
"publishedDate": "2013-12-14T17:21Z"
}
}
}
RHSA-2014:0089
Vulnerability from csaf_redhat - Published: 2014-01-22 18:31 - Updated: 2026-01-13 22:34Summary
Red Hat Security Advisory: openstack-keystone security and bug fix update
Severity
Moderate
Notes
Topic: Updated openstack-keystone packages that fix one security issue and several
bugs are now available for Red Hat Enterprise Linux OpenStack Platform 4.0.
The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
Details: The openstack-keystone packages provide keystone, a Python implementation
of the OpenStack Identity service API, which provides Identity, Token,
Catalog, and Policy services.
It was found that the ec2token API in keystone, which is used to generate
EC2-style (Amazon Elastic Compute Cloud) credentials, could generate a
token not scoped to a particular trust when creating a token from a
received trust-scoped token. A remote attacker could use this flaw to
retrieve a token that elevated their privileges to all of the trustor's
roles. Note that only OpenStack Identity setups that have EC2-style
authentication enabled were affected. (CVE-2013-6391)
Red Hat would like to thank Jeremy Stanley of the OpenStack Project for
reporting this issue. Upstream acknowledges Steven Hardy of Red Hat as the
original reporter.
These updated packages have been upgraded to upstream version 2013.2.1,
which provides a number of bug fixes over the previous version.
(BZ#1045408)
All openstack-keystone users are advised to upgrade to these updated
packages, which correct these issues.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
4.0 ()
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RHOS-4.0:openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RHOS-4.0:python-keystone-0:2013.2.1-1.el6ost.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
8 references
Acknowledgments
OpenStack Project
Jeremy Stanley
Red Hat
Steven Hardy
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated openstack-keystone packages that fix one security issue and several\nbugs are now available for Red Hat Enterprise Linux OpenStack Platform 4.0.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The openstack-keystone packages provide keystone, a Python implementation\nof the OpenStack Identity service API, which provides Identity, Token,\nCatalog, and Policy services.\n\nIt was found that the ec2token API in keystone, which is used to generate\nEC2-style (Amazon Elastic Compute Cloud) credentials, could generate a\ntoken not scoped to a particular trust when creating a token from a\nreceived trust-scoped token. A remote attacker could use this flaw to\nretrieve a token that elevated their privileges to all of the trustor\u0027s\nroles. Note that only OpenStack Identity setups that have EC2-style\nauthentication enabled were affected. (CVE-2013-6391)\n\nRed Hat would like to thank Jeremy Stanley of the OpenStack Project for\nreporting this issue. Upstream acknowledges Steven Hardy of Red Hat as the\noriginal reporter.\n\nThese updated packages have been upgraded to upstream version 2013.2.1,\nwhich provides a number of bug fixes over the previous version.\n(BZ#1045408)\n\nAll openstack-keystone users are advised to upgrade to these updated\npackages, which correct these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0089",
"url": "https://access.redhat.com/errata/RHSA-2014:0089"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1039164",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1039164"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0089.json"
}
],
"title": "Red Hat Security Advisory: openstack-keystone security and bug fix update",
"tracking": {
"current_release_date": "2026-01-13T22:34:47+00:00",
"generator": {
"date": "2026-01-13T22:34:47+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.15"
}
},
"id": "RHSA-2014:0089",
"initial_release_date": "2014-01-22T18:31:29+00:00",
"revision_history": [
{
"date": "2014-01-22T18:31:29+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2014-01-22T18:31:29+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-01-13T22:34:47+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 4.0",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 4.0",
"product_id": "6Server-RHOS-4.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:4::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "openstack-keystone-0:2013.2.1-1.el6ost.noarch",
"product": {
"name": "openstack-keystone-0:2013.2.1-1.el6ost.noarch",
"product_id": "openstack-keystone-0:2013.2.1-1.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openstack-keystone@2013.2.1-1.el6ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch",
"product": {
"name": "openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch",
"product_id": "openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openstack-keystone-doc@2013.2.1-1.el6ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-keystone-0:2013.2.1-1.el6ost.noarch",
"product": {
"name": "python-keystone-0:2013.2.1-1.el6ost.noarch",
"product_id": "python-keystone-0:2013.2.1-1.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-keystone@2013.2.1-1.el6ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "openstack-keystone-0:2013.2.1-1.el6ost.src",
"product": {
"name": "openstack-keystone-0:2013.2.1-1.el6ost.src",
"product_id": "openstack-keystone-0:2013.2.1-1.el6ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openstack-keystone@2013.2.1-1.el6ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "openstack-keystone-0:2013.2.1-1.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
"product_id": "6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.noarch"
},
"product_reference": "openstack-keystone-0:2013.2.1-1.el6ost.noarch",
"relates_to_product_reference": "6Server-RHOS-4.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openstack-keystone-0:2013.2.1-1.el6ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
"product_id": "6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.src"
},
"product_reference": "openstack-keystone-0:2013.2.1-1.el6ost.src",
"relates_to_product_reference": "6Server-RHOS-4.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
"product_id": "6Server-RHOS-4.0:openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch"
},
"product_reference": "openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch",
"relates_to_product_reference": "6Server-RHOS-4.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-keystone-0:2013.2.1-1.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
"product_id": "6Server-RHOS-4.0:python-keystone-0:2013.2.1-1.el6ost.noarch"
},
"product_reference": "python-keystone-0:2013.2.1-1.el6ost.noarch",
"relates_to_product_reference": "6Server-RHOS-4.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Jeremy Stanley"
],
"organization": "OpenStack Project"
},
{
"names": [
"Steven Hardy"
],
"organization": "Red Hat",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2013-6391",
"discovery_date": "2013-12-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1039164"
}
],
"notes": [
{
"category": "description",
"text": "The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Keystone: trust circumvention through EC2-style tokens",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.noarch",
"6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.src",
"6Server-RHOS-4.0:openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch",
"6Server-RHOS-4.0:python-keystone-0:2013.2.1-1.el6ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-6391"
},
{
"category": "external",
"summary": "RHBZ#1039164",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1039164"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-6391",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6391"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6391",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6391"
}
],
"release_date": "2013-12-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-01-22T18:31:29+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.noarch",
"6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.src",
"6Server-RHOS-4.0:openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch",
"6Server-RHOS-4.0:python-keystone-0:2013.2.1-1.el6ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.noarch",
"6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.src",
"6Server-RHOS-4.0:openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch",
"6Server-RHOS-4.0:python-keystone-0:2013.2.1-1.el6ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Keystone: trust circumvention through EC2-style tokens"
}
]
}
RHSA-2014:0368
Vulnerability from csaf_redhat - Published: 2014-04-03 20:18 - Updated: 2026-01-13 22:31Summary
Red Hat Security Advisory: openstack-keystone security update
Severity
Moderate
Notes
Topic: Updated openstack-keystone packages that fix two security issues are now
available for Red Hat Enterprise Linux OpenStack Platform 3.0.
The Red Hat Security Response Team has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details: The OpenStack Identity service (keystone) authenticates and authorizes
OpenStack users by keeping track of users and their permitted activities.
The Identity service supports multiple forms of authentication including
user name and password credentials, token-based systems, and
AWS-style logins.
It was found that the ec2token API in keystone, which is used to generate
EC2-style (Amazon Elastic Compute Cloud) credentials, could generate a
token not scoped to a particular trust when creating a token from a
received trust-scoped token. A remote attacker could use this flaw to
retrieve a token that elevated their privileges to all of the trustor's
roles. Note that only OpenStack Identity setups that have EC2-style
authentication enabled were affected. (CVE-2013-6391)
It was found that the the memcache token back end of OpenStack Identity did
not correctly invalidate a revoked trust token, allowing users with revoked
tokens to retain access to services they should no longer be able to
access. Note that only OpenStack Identity setups using the memcache back
end for tokens were affected. (CVE-2014-2237)
Red Hat would like to thank Jeremy Stanley of the OpenStack Project for
reporting CVE-2013-6391. Upstream acknowledges Steven Hardy of Red Hat as
the original reporter of CVE-2013-6391.
All openstack-keystone users are advised to upgrade to these updated
packages, which correct these issues.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
4.0 ()
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-Grizzly:openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-Grizzly:python-keystone-0:2013.1.5-2.el6ost.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.
4.0 ()
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-Grizzly:openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-Grizzly:python-keystone-0:2013.1.5-2.el6ost.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
13 references
Acknowledgments
OpenStack Project
Jeremy Stanley
Red Hat
Steven Hardy
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated openstack-keystone packages that fix two security issues are now\navailable for Red Hat Enterprise Linux OpenStack Platform 3.0.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The OpenStack Identity service (keystone) authenticates and authorizes\nOpenStack users by keeping track of users and their permitted activities.\nThe Identity service supports multiple forms of authentication including\nuser name and password credentials, token-based systems, and\nAWS-style logins.\n\nIt was found that the ec2token API in keystone, which is used to generate\nEC2-style (Amazon Elastic Compute Cloud) credentials, could generate a\ntoken not scoped to a particular trust when creating a token from a\nreceived trust-scoped token. A remote attacker could use this flaw to\nretrieve a token that elevated their privileges to all of the trustor\u0027s\nroles. Note that only OpenStack Identity setups that have EC2-style\nauthentication enabled were affected. (CVE-2013-6391)\n\nIt was found that the the memcache token back end of OpenStack Identity did\nnot correctly invalidate a revoked trust token, allowing users with revoked\ntokens to retain access to services they should no longer be able to\naccess. Note that only OpenStack Identity setups using the memcache back\nend for tokens were affected. (CVE-2014-2237)\n\nRed Hat would like to thank Jeremy Stanley of the OpenStack Project for\nreporting CVE-2013-6391. Upstream acknowledges Steven Hardy of Red Hat as\nthe original reporter of CVE-2013-6391.\n\nAll openstack-keystone users are advised to upgrade to these updated\npackages, which correct these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0368",
"url": "https://access.redhat.com/errata/RHSA-2014:0368"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1039164",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1039164"
},
{
"category": "external",
"summary": "1071434",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1071434"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0368.json"
}
],
"title": "Red Hat Security Advisory: openstack-keystone security update",
"tracking": {
"current_release_date": "2026-01-13T22:31:12+00:00",
"generator": {
"date": "2026-01-13T22:31:12+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.15"
}
},
"id": "RHSA-2014:0368",
"initial_release_date": "2014-04-03T20:18:06+00:00",
"revision_history": [
{
"date": "2014-04-03T20:18:06+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2014-04-03T20:18:07+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-01-13T22:31:12+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 3.0",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 3.0",
"product_id": "6Server-Grizzly",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:3::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"product": {
"name": "openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"product_id": "openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openstack-keystone@2013.1.5-2.el6ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-keystone-0:2013.1.5-2.el6ost.noarch",
"product": {
"name": "python-keystone-0:2013.1.5-2.el6ost.noarch",
"product_id": "python-keystone-0:2013.1.5-2.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-keystone@2013.1.5-2.el6ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"product": {
"name": "openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"product_id": "openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openstack-keystone-doc@2013.1.5-2.el6ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "openstack-keystone-0:2013.1.5-2.el6ost.src",
"product": {
"name": "openstack-keystone-0:2013.1.5-2.el6ost.src",
"product_id": "openstack-keystone-0:2013.1.5-2.el6ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openstack-keystone@2013.1.5-2.el6ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "openstack-keystone-0:2013.1.5-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
"product_id": "6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.noarch"
},
"product_reference": "openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"relates_to_product_reference": "6Server-Grizzly"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openstack-keystone-0:2013.1.5-2.el6ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
"product_id": "6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.src"
},
"product_reference": "openstack-keystone-0:2013.1.5-2.el6ost.src",
"relates_to_product_reference": "6Server-Grizzly"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
"product_id": "6Server-Grizzly:openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch"
},
"product_reference": "openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"relates_to_product_reference": "6Server-Grizzly"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-keystone-0:2013.1.5-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
"product_id": "6Server-Grizzly:python-keystone-0:2013.1.5-2.el6ost.noarch"
},
"product_reference": "python-keystone-0:2013.1.5-2.el6ost.noarch",
"relates_to_product_reference": "6Server-Grizzly"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Jeremy Stanley"
],
"organization": "OpenStack Project"
},
{
"names": [
"Steven Hardy"
],
"organization": "Red Hat",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2013-6391",
"discovery_date": "2013-12-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1039164"
}
],
"notes": [
{
"category": "description",
"text": "The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Keystone: trust circumvention through EC2-style tokens",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.src",
"6Server-Grizzly:openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:python-keystone-0:2013.1.5-2.el6ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-6391"
},
{
"category": "external",
"summary": "RHBZ#1039164",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1039164"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-6391",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6391"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6391",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6391"
}
],
"release_date": "2013-12-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T20:18:06+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.src",
"6Server-Grizzly:openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:python-keystone-0:2013.1.5-2.el6ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0368"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.src",
"6Server-Grizzly:openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:python-keystone-0:2013.1.5-2.el6ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Keystone: trust circumvention through EC2-style tokens"
},
{
"cve": "CVE-2014-2237",
"cwe": {
"id": "CWE-613",
"name": "Insufficient Session Expiration"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1071434"
}
],
"notes": [
{
"category": "description",
"text": "The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee\u0027s token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openstack-keystone: trustee token revocation does not work with memcache backend",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.src",
"6Server-Grizzly:openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:python-keystone-0:2013.1.5-2.el6ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-2237"
},
{
"category": "external",
"summary": "RHBZ#1071434",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1071434"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-2237",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-2237"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-2237",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2237"
}
],
"release_date": "2013-12-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T20:18:06+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.src",
"6Server-Grizzly:openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:python-keystone-0:2013.1.5-2.el6ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0368"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.src",
"6Server-Grizzly:openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:python-keystone-0:2013.1.5-2.el6ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openstack-keystone: trustee token revocation does not work with memcache backend"
}
]
}
RHSA-2014_0089
Vulnerability from csaf_redhat - Published: 2014-01-22 18:31 - Updated: 2024-11-22 07:43Summary
Red Hat Security Advisory: openstack-keystone security and bug fix update
Severity
Moderate
Notes
Topic: Updated openstack-keystone packages that fix one security issue and several
bugs are now available for Red Hat Enterprise Linux OpenStack Platform 4.0.
The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
Details: The openstack-keystone packages provide keystone, a Python implementation
of the OpenStack Identity service API, which provides Identity, Token,
Catalog, and Policy services.
It was found that the ec2token API in keystone, which is used to generate
EC2-style (Amazon Elastic Compute Cloud) credentials, could generate a
token not scoped to a particular trust when creating a token from a
received trust-scoped token. A remote attacker could use this flaw to
retrieve a token that elevated their privileges to all of the trustor's
roles. Note that only OpenStack Identity setups that have EC2-style
authentication enabled were affected. (CVE-2013-6391)
Red Hat would like to thank Jeremy Stanley of the OpenStack Project for
reporting this issue. Upstream acknowledges Steven Hardy of Red Hat as the
original reporter.
These updated packages have been upgraded to upstream version 2013.2.1,
which provides a number of bug fixes over the previous version.
(BZ#1045408)
All openstack-keystone users are advised to upgrade to these updated
packages, which correct these issues.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
4.0 ()
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RHOS-4.0:openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-RHOS-4.0:python-keystone-0:2013.2.1-1.el6ost.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
8 references
Acknowledgments
OpenStack Project
Jeremy Stanley
Red Hat
Steven Hardy
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated openstack-keystone packages that fix one security issue and several\nbugs are now available for Red Hat Enterprise Linux OpenStack Platform 4.0.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The openstack-keystone packages provide keystone, a Python implementation\nof the OpenStack Identity service API, which provides Identity, Token,\nCatalog, and Policy services.\n\nIt was found that the ec2token API in keystone, which is used to generate\nEC2-style (Amazon Elastic Compute Cloud) credentials, could generate a\ntoken not scoped to a particular trust when creating a token from a\nreceived trust-scoped token. A remote attacker could use this flaw to\nretrieve a token that elevated their privileges to all of the trustor\u0027s\nroles. Note that only OpenStack Identity setups that have EC2-style\nauthentication enabled were affected. (CVE-2013-6391)\n\nRed Hat would like to thank Jeremy Stanley of the OpenStack Project for\nreporting this issue. Upstream acknowledges Steven Hardy of Red Hat as the\noriginal reporter.\n\nThese updated packages have been upgraded to upstream version 2013.2.1,\nwhich provides a number of bug fixes over the previous version.\n(BZ#1045408)\n\nAll openstack-keystone users are advised to upgrade to these updated\npackages, which correct these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0089",
"url": "https://access.redhat.com/errata/RHSA-2014:0089"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1039164",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1039164"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0089.json"
}
],
"title": "Red Hat Security Advisory: openstack-keystone security and bug fix update",
"tracking": {
"current_release_date": "2024-11-22T07:43:55+00:00",
"generator": {
"date": "2024-11-22T07:43:55+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2014:0089",
"initial_release_date": "2014-01-22T18:31:29+00:00",
"revision_history": [
{
"date": "2014-01-22T18:31:29+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2014-01-22T18:31:29+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T07:43:55+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 4.0",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 4.0",
"product_id": "6Server-RHOS-4.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:4::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "openstack-keystone-0:2013.2.1-1.el6ost.noarch",
"product": {
"name": "openstack-keystone-0:2013.2.1-1.el6ost.noarch",
"product_id": "openstack-keystone-0:2013.2.1-1.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openstack-keystone@2013.2.1-1.el6ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch",
"product": {
"name": "openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch",
"product_id": "openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openstack-keystone-doc@2013.2.1-1.el6ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-keystone-0:2013.2.1-1.el6ost.noarch",
"product": {
"name": "python-keystone-0:2013.2.1-1.el6ost.noarch",
"product_id": "python-keystone-0:2013.2.1-1.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-keystone@2013.2.1-1.el6ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "openstack-keystone-0:2013.2.1-1.el6ost.src",
"product": {
"name": "openstack-keystone-0:2013.2.1-1.el6ost.src",
"product_id": "openstack-keystone-0:2013.2.1-1.el6ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openstack-keystone@2013.2.1-1.el6ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "openstack-keystone-0:2013.2.1-1.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
"product_id": "6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.noarch"
},
"product_reference": "openstack-keystone-0:2013.2.1-1.el6ost.noarch",
"relates_to_product_reference": "6Server-RHOS-4.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openstack-keystone-0:2013.2.1-1.el6ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
"product_id": "6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.src"
},
"product_reference": "openstack-keystone-0:2013.2.1-1.el6ost.src",
"relates_to_product_reference": "6Server-RHOS-4.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
"product_id": "6Server-RHOS-4.0:openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch"
},
"product_reference": "openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch",
"relates_to_product_reference": "6Server-RHOS-4.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-keystone-0:2013.2.1-1.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 4.0",
"product_id": "6Server-RHOS-4.0:python-keystone-0:2013.2.1-1.el6ost.noarch"
},
"product_reference": "python-keystone-0:2013.2.1-1.el6ost.noarch",
"relates_to_product_reference": "6Server-RHOS-4.0"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Jeremy Stanley"
],
"organization": "OpenStack Project"
},
{
"names": [
"Steven Hardy"
],
"organization": "Red Hat",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2013-6391",
"discovery_date": "2013-12-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1039164"
}
],
"notes": [
{
"category": "description",
"text": "The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Keystone: trust circumvention through EC2-style tokens",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.noarch",
"6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.src",
"6Server-RHOS-4.0:openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch",
"6Server-RHOS-4.0:python-keystone-0:2013.2.1-1.el6ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-6391"
},
{
"category": "external",
"summary": "RHBZ#1039164",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1039164"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-6391",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6391"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6391",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6391"
}
],
"release_date": "2013-12-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-01-22T18:31:29+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.noarch",
"6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.src",
"6Server-RHOS-4.0:openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch",
"6Server-RHOS-4.0:python-keystone-0:2013.2.1-1.el6ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0089"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.noarch",
"6Server-RHOS-4.0:openstack-keystone-0:2013.2.1-1.el6ost.src",
"6Server-RHOS-4.0:openstack-keystone-doc-0:2013.2.1-1.el6ost.noarch",
"6Server-RHOS-4.0:python-keystone-0:2013.2.1-1.el6ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Keystone: trust circumvention through EC2-style tokens"
}
]
}
RHSA-2014_0368
Vulnerability from csaf_redhat - Published: 2014-04-03 20:18 - Updated: 2024-11-22 07:47Summary
Red Hat Security Advisory: openstack-keystone security update
Severity
Moderate
Notes
Topic: Updated openstack-keystone packages that fix two security issues are now
available for Red Hat Enterprise Linux OpenStack Platform 3.0.
The Red Hat Security Response Team has rated this update as having Moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details: The OpenStack Identity service (keystone) authenticates and authorizes
OpenStack users by keeping track of users and their permitted activities.
The Identity service supports multiple forms of authentication including
user name and password credentials, token-based systems, and
AWS-style logins.
It was found that the ec2token API in keystone, which is used to generate
EC2-style (Amazon Elastic Compute Cloud) credentials, could generate a
token not scoped to a particular trust when creating a token from a
received trust-scoped token. A remote attacker could use this flaw to
retrieve a token that elevated their privileges to all of the trustor's
roles. Note that only OpenStack Identity setups that have EC2-style
authentication enabled were affected. (CVE-2013-6391)
It was found that the the memcache token back end of OpenStack Identity did
not correctly invalidate a revoked trust token, allowing users with revoked
tokens to retain access to services they should no longer be able to
access. Note that only OpenStack Identity setups using the memcache back
end for tokens were affected. (CVE-2014-2237)
Red Hat would like to thank Jeremy Stanley of the OpenStack Project for
reporting CVE-2013-6391. Upstream acknowledges Steven Hardy of Red Hat as
the original reporter of CVE-2013-6391.
All openstack-keystone users are advised to upgrade to these updated
packages, which correct these issues.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
4.0 ()
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-Grizzly:openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-Grizzly:python-keystone-0:2013.1.5-2.el6ost.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.
4.0 ()
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: 6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-Grizzly:openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch | — |
Vendor Fix
fix
|
|
| Unresolved product id: 6Server-Grizzly:python-keystone-0:2013.1.5-2.el6ost.noarch | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
References
13 references
Acknowledgments
OpenStack Project
Jeremy Stanley
Red Hat
Steven Hardy
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated openstack-keystone packages that fix two security issues are now\navailable for Red Hat Enterprise Linux OpenStack Platform 3.0.\n\nThe Red Hat Security Response Team has rated this update as having Moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The OpenStack Identity service (keystone) authenticates and authorizes\nOpenStack users by keeping track of users and their permitted activities.\nThe Identity service supports multiple forms of authentication including\nuser name and password credentials, token-based systems, and\nAWS-style logins.\n\nIt was found that the ec2token API in keystone, which is used to generate\nEC2-style (Amazon Elastic Compute Cloud) credentials, could generate a\ntoken not scoped to a particular trust when creating a token from a\nreceived trust-scoped token. A remote attacker could use this flaw to\nretrieve a token that elevated their privileges to all of the trustor\u0027s\nroles. Note that only OpenStack Identity setups that have EC2-style\nauthentication enabled were affected. (CVE-2013-6391)\n\nIt was found that the the memcache token back end of OpenStack Identity did\nnot correctly invalidate a revoked trust token, allowing users with revoked\ntokens to retain access to services they should no longer be able to\naccess. Note that only OpenStack Identity setups using the memcache back\nend for tokens were affected. (CVE-2014-2237)\n\nRed Hat would like to thank Jeremy Stanley of the OpenStack Project for\nreporting CVE-2013-6391. Upstream acknowledges Steven Hardy of Red Hat as\nthe original reporter of CVE-2013-6391.\n\nAll openstack-keystone users are advised to upgrade to these updated\npackages, which correct these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2014:0368",
"url": "https://access.redhat.com/errata/RHSA-2014:0368"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1039164",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1039164"
},
{
"category": "external",
"summary": "1071434",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1071434"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0368.json"
}
],
"title": "Red Hat Security Advisory: openstack-keystone security update",
"tracking": {
"current_release_date": "2024-11-22T07:47:30+00:00",
"generator": {
"date": "2024-11-22T07:47:30+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2014:0368",
"initial_release_date": "2014-04-03T20:18:06+00:00",
"revision_history": [
{
"date": "2014-04-03T20:18:06+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2014-04-03T20:18:07+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T07:47:30+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux OpenStack Platform 3.0",
"product": {
"name": "Red Hat Enterprise Linux OpenStack Platform 3.0",
"product_id": "6Server-Grizzly",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openstack:3::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenStack Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"product": {
"name": "openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"product_id": "openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openstack-keystone@2013.1.5-2.el6ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python-keystone-0:2013.1.5-2.el6ost.noarch",
"product": {
"name": "python-keystone-0:2013.1.5-2.el6ost.noarch",
"product_id": "python-keystone-0:2013.1.5-2.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python-keystone@2013.1.5-2.el6ost?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"product": {
"name": "openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"product_id": "openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openstack-keystone-doc@2013.1.5-2.el6ost?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "openstack-keystone-0:2013.1.5-2.el6ost.src",
"product": {
"name": "openstack-keystone-0:2013.1.5-2.el6ost.src",
"product_id": "openstack-keystone-0:2013.1.5-2.el6ost.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openstack-keystone@2013.1.5-2.el6ost?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "openstack-keystone-0:2013.1.5-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
"product_id": "6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.noarch"
},
"product_reference": "openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"relates_to_product_reference": "6Server-Grizzly"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openstack-keystone-0:2013.1.5-2.el6ost.src as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
"product_id": "6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.src"
},
"product_reference": "openstack-keystone-0:2013.1.5-2.el6ost.src",
"relates_to_product_reference": "6Server-Grizzly"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
"product_id": "6Server-Grizzly:openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch"
},
"product_reference": "openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"relates_to_product_reference": "6Server-Grizzly"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python-keystone-0:2013.1.5-2.el6ost.noarch as a component of Red Hat Enterprise Linux OpenStack Platform 3.0",
"product_id": "6Server-Grizzly:python-keystone-0:2013.1.5-2.el6ost.noarch"
},
"product_reference": "python-keystone-0:2013.1.5-2.el6ost.noarch",
"relates_to_product_reference": "6Server-Grizzly"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Jeremy Stanley"
],
"organization": "OpenStack Project"
},
{
"names": [
"Steven Hardy"
],
"organization": "Red Hat",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2013-6391",
"discovery_date": "2013-12-06T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1039164"
}
],
"notes": [
{
"category": "description",
"text": "The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Keystone: trust circumvention through EC2-style tokens",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.src",
"6Server-Grizzly:openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:python-keystone-0:2013.1.5-2.el6ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-6391"
},
{
"category": "external",
"summary": "RHBZ#1039164",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1039164"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-6391",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-6391"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6391",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6391"
}
],
"release_date": "2013-12-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T20:18:06+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.src",
"6Server-Grizzly:openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:python-keystone-0:2013.1.5-2.el6ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0368"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.src",
"6Server-Grizzly:openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:python-keystone-0:2013.1.5-2.el6ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Keystone: trust circumvention through EC2-style tokens"
},
{
"cve": "CVE-2014-2237",
"cwe": {
"id": "CWE-613",
"name": "Insufficient Session Expiration"
},
"discovery_date": "2014-02-28T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1071434"
}
],
"notes": [
{
"category": "description",
"text": "The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee\u0027s token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openstack-keystone: trustee token revocation does not work with memcache backend",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.src",
"6Server-Grizzly:openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:python-keystone-0:2013.1.5-2.el6ost.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-2237"
},
{
"category": "external",
"summary": "RHBZ#1071434",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1071434"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-2237",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-2237"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-2237",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-2237"
}
],
"release_date": "2013-12-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2014-04-03T20:18:06+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/site/articles/11258",
"product_ids": [
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.src",
"6Server-Grizzly:openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:python-keystone-0:2013.1.5-2.el6ost.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2014:0368"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:openstack-keystone-0:2013.1.5-2.el6ost.src",
"6Server-Grizzly:openstack-keystone-doc-0:2013.1.5-2.el6ost.noarch",
"6Server-Grizzly:python-keystone-0:2013.1.5-2.el6ost.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "openstack-keystone: trustee token revocation does not work with memcache backend"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…