Skip to content
OpenAdvisories
Medium RHSA-2014:1121 3 CVEs

Red Hat Security Advisory: openstack-keystone security and bug fix update

Published Sep 15, 2024 · Updated Aug 1, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · OpenStack 5 openstack:5::el7 openstack-keystone 0:2014.1.2.1-1.el7ost
Red Hat · OpenStack 5 openstack:5::el7 openstack-keystone-doc 0:2014.1.2.1-1.el7ost
Red Hat · OpenStack 5 openstack:5::el7 python-keystone 0:2014.1.2.1-1.el7ost

Vulnerabilities 3

  • Medium 6.5
    CVE-2014-5251

    OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events

    The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain…

    keystone keystone keystone Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2014-5252

    OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events

    The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET o…

    keystone keystone keystone Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2014-5253

    OpenStack Keystone Domain-scoped tokens don't get revoked

    OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated users to retain access via a domain-scoped token for that domain.

    keystone keystone keystone Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#low
  • article
    https://launchpad.net/keystone/icehouse/2014.1.2
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1127250
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1127253
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1127259
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1127421
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1121.json
  • report
    https://access.redhat.com/security/cve/CVE-2014-5251
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-5251
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-5251
  • report
    https://access.redhat.com/security/cve/CVE-2014-5252
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-5252
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-5252
  • report
    https://access.redhat.com/security/cve/CVE-2014-5253
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2014-5253
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2014-5253