Description
OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 2 | python-keystone +2 | 2012.2.3-7.el6ost | RHSA-2013:0708 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | keystone | >= 2012.2, < 2012.2.4 | 2012.2.4 | GHSA-22q6-wwq7-2jj9 |
Advisories 1
- RHSA-2013:0708 Red Hat Security Advisory: openstack-keystone security and bug fix update Red Hat Security Advisories (RHSA) · Aug 8, 2026
References
- [oss-security] 20130320 [OSSA 2013-009] Keystone PKI tokens online validation bypasses revocation check (CVE-2013-1865) mailing-list
- 52657 third-party-advisory
- openSUSE-SU-2013:0565 vendor-advisory
- FEDORA-2013-4590 vendor-advisory
- https://bugs.launchpad.net/keystone/+bug/1129713
- https://review.openstack.org/#/c/24906/
- 58616 vdb-entry
- USN-1772-1 vendor-advisory
- 91532 vdb-entry
- RHSA-2013:0708 vendor-advisory