Skip to content
OpenAdvisories
Unscored RHSA-2014:0994 2 CVEs

Red Hat Security Advisory: openstack-keystone security update

Published Sep 15, 2024 · Updated Aug 1, 2026

Ecosystem: Red Hat

Fixed packages 6

ReleasePackageFixed in
Red Hat · OpenStack 3 openstack:3::el6 openstack-keystone 0:2013.1.5-3.el6ost
Red Hat · OpenStack 3 openstack:3::el6 openstack-keystone-doc 0:2013.1.5-3.el6ost
Red Hat · OpenStack 3 openstack:3::el6 python-keystone 0:2013.1.5-3.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-keystone 0:2013.2.3-7.el6ost
Red Hat · OpenStack 4 openstack:4::el6 openstack-keystone-doc 0:2013.2.3-7.el6ost
Red Hat · OpenStack 4 openstack:4::el6 python-keystone 0:2013.2.3-7.el6ost

Vulnerabilities 2

  • Medium —
    CVE-2014-3476

    OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege

    OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonati…

    keystone keystone keystone Debian Ubuntu PyPI
  • Unscored —
    CVE-2014-3520

    OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticat…

    keystone keystone Debian Ubuntu

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1104524
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1112668
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0994.json
  • report
    https://access.redhat.com/security/cve/CVE-2014-3476
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-3476
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-3476
  • report
    https://access.redhat.com/security/cve/CVE-2014-3520
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-3520
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-3520