Skip to content
OpenAdvisories
Medium USN-2324-1 5 CVEs

keystone vulnerabilities

Published Aug 21, 2014 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Steven Hardy discovered that OpenStack Keystone did not properly handle
chained delegation. A remove authenticated attacker could use this to
gain privileges by creating a new token with additional roles.
(CVE-2014-3476)

Jamie Lennox discovered that OpenStack Keystone did not properly validate
the project id. A remote authenticated attacker may be able to use this to
access other projects. (CVE-2014-3520)

Brant Knudson and Lance Bragstad discovered that OpenStack Keystone would
not always revoke tokens correctly. If Keystone were configured to use
revocation events, a remote authenticated attacker could continue to have
access to resources. (CVE-2014-5251, CVE-2014-5252, CVE-2014-5253)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS keystone 1:2014.1.2.1-0ubuntu1.1

Vulnerabilities 5

  • Medium 6.5
    CVE-2014-5251

    OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events

    The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain…

    keystone keystone keystone Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2014-5252

    OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events

    The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET o…

    keystone keystone keystone Debian Ubuntu PyPI
  • Medium 6.5
    CVE-2014-5253

    OpenStack Keystone Domain-scoped tokens don't get revoked

    OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated users to retain access via a domain-scoped token for that domain.

    keystone keystone keystone Debian Ubuntu PyPI
  • Medium —
    CVE-2014-3476

    OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege

    OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonati…

    keystone keystone keystone Debian Ubuntu PyPI
  • Unscored —
    CVE-2014-3520

    OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticat…

    keystone keystone Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2014-3476
  • report
    https://ubuntu.com/security/CVE-2014-3520
  • report
    https://ubuntu.com/security/CVE-2014-5251
  • report
    https://ubuntu.com/security/CVE-2014-5252
  • report
    https://ubuntu.com/security/CVE-2014-5253