CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2015-7546
https://notcve.org/view.php?id=CVE-2015-7546
The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers, which allows remote authenticated users to bypass intended access restrictions and gain access to cloud resources by manipulating byte fields within a revoked token. El servicio de identificación en OpenStack Identity (Keystone) en versiones anteriores a 2015.1.3 (Kilo) y 8.0.x en versiones anteriores a 8.0.2 (Liberty) y keystonemiddleware (anteriormente python-keystoneclient) en versiones anteriores a 1.5.4 (Kilo) y Liberty en versiones anteriores a 2.3.3 no invalida correctamente los tokens de autorización cuando utiliza los proveedores de token PKI o PKIZ, lo que permite a usuarios remotos autenticados eludir las restricciones de acceso previstas y obtener acceso a recursos de la nube manipulando los campos byte dentro de un token revocado. • http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html http://www.securityfocus.com/bid/80498 https://bugs.launchpad.net/keystone/+bug/1490804 https://security.openstack.org/ossa/OSSA-2016-005.html https://wiki.openstack.org/wiki/OSSN/OSSN-0062 • CWE-522: Insufficiently Protected Credentials •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2014-2828 – openstack-keystone: denial of service via V3 API authentication chaining
https://notcve.org/view.php?id=CVE-2014-2828
The V3 API in OpenStack Identity (Keystone) 2013.1 before 2013.2.4 and icehouse before icehouse-rc2 allows remote attackers to cause a denial of service (CPU consumption) via a large number of the same authentication method in a request, aka "authentication chaining." La API V3 en OpenStack Identity (Keystone) 2013.1 anterior a 2013.2.4 y icehouse anterior a icehouse-rc2 permite a atacantes remotos causar una denegación de servicio (consumo de CPU) a través de un número grande del mismo método de autenticación en una solicitud, también conocido como "encadenamiento de autenticación." A flaw was found in the keystone V3 API. An attacker could send a single request with the same authentication method multiple times, possibly leading to a denial of service due to generating excessive load with minimal requests. Only keystone setups with the V3 API enabled were affected by this issue. • http://rhn.redhat.com/errata/RHSA-2014-1688.html http://www.openwall.com/lists/oss-security/2014/04/10/20 https://bugs.launchpad.net/keystone/+bug/1300274 https://access.redhat.com/security/cve/CVE-2014-2828 https://bugzilla.redhat.com/show_bug.cgi?id=1086211 • CWE-287: Improper Authentication CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.0EPSS: 0%CPEs: 6EXPL: 0CVE-2014-2237 – openstack-keystone: trustee token revocation does not work with memcache backend
https://notcve.org/view.php?id=CVE-2014-2237
The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions. El memcache token backend en OpenStack Identity (Keystone) 2013.1 hasta 2.013.1.4, 2013.2 hasta 2013.2.2 y icehouse anterior a icehouse-3, cuando se emite un token de confianza con suplantación habilitada, no incluye este token en la lista de indice de tokens del trustee, lo que previene el token ser invalidado por la revocación de tokens en masa y permite al trustee evadir restricciones de acceso. • http://rhn.redhat.com/errata/RHSA-2014-0580.html http://www.openwall.com/lists/oss-security/2014/03/04/16 http://www.securityfocus.com/bid/65895 https://bugs.launchpad.net/keystone/+bug/1260080 https://access.redhat.com/security/cve/CVE-2014-2237 https://bugzilla.redhat.com/show_bug.cgi?id=1071434 • CWE-264: Permissions, Privileges, and Access Controls CWE-613: Insufficient Session Expiration •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2013-4222 – OpenStack: Keystone disabling a tenant does not disable a user token
https://notcve.org/view.php?id=CVE-2013-4222
OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token. OpenStack Identity (Keystone) Folsom, Grizzly 2013.1.3 y anteriores, y Havana anterior havana-3 no revoca correctamente los tokens de usuario cuando un inquilino esta desactivado, lo que permite a los usuarios remotos autenticados conservan el acceso a través del token. • http://lists.fedoraproject.org/pipermail/package-announce/2013-September/116489.html http://rhn.redhat.com/errata/RHSA-2013-1524.html http://www.ubuntu.com/usn/USN-2002-1 https://bugs.launchpad.net/ossn/+bug/1179955 https://access.redhat.com/security/cve/CVE-2013-4222 https://bugzilla.redhat.com/show_bug.cgi?id=995598 • CWE-522: Insufficiently Protected Credentials CWE-613: Insufficient Session Expiration •
CVSS: 5.0EPSS: 0%CPEs: 9EXPL: 0CVE-2013-4294 – OpenStack: Keystone Token revocation failure using Keystone memcache/KVS backends
https://notcve.org/view.php?id=CVE-2013-4294
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token. El (1) mamcache y (2) KVS token backends en OpenStack Identity (Keystone) Folsom 2012.2.x y Grizzly anterior a la versión 2013.1.4 no compara correctamente la lista de revocación del token PKI con tokens PKI, lo que permite a atacantes remotos evitar restricciones de acceso a través de un token PKI revocado. • http://osvdb.org/97237 http://rhn.redhat.com/errata/RHSA-2013-1285.html http://seclists.org/oss-sec/2013/q3/586 http://secunia.com/advisories/54706 http://www.ubuntu.com/usn/USN-2002-1 https://bugs.launchpad.net/keystone/+bug/1202952 https://access.redhat.com/security/cve/CVE-2013-4294 https://bugzilla.redhat.com/show_bug.cgi?id=1004452 • CWE-264: Permissions, Privileges, and Access Controls CWE-613: Insufficient Session Expiration •