Description
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | keystone | 2013.1.3-2 | — |
| Debian 13 | keystone | 2013.1.3-2 | — |
| Debian 12 | keystone | 2013.1.3-2 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 3 | python-keystone +2 | 2013.1.3-2.el6ost | RHSA-2013:1285 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | keystone | >= 2012.2.0, < 2013.1.4 | 2013.1.4 | GHSA-5qpp-v56f-mqfm |
Advisories 1
- RHSA-2013:1285 Red Hat Security Advisory: openstack-keystone security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
References
- 97237 vdb-entry
- USN-2002-1 vendor-advisory
- 54706 third-party-advisory
- [oss-security] 20130911 [OSSA 2013-025] Token revocation failure using Keystone memcache/KVS backends (CVE-2013-4294) mailing-list
- https://bugs.launchpad.net/keystone/+bug/1202952
- RHSA-2013:1285 vendor-advisory