Description
The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | keystone | 2013.2.1-1 | — |
| Debian 13 | keystone | 2013.2.1-1 | — |
| Debian 12 | keystone | 2013.2.1-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 4 | python-keystone +2 | 2013.2.1-1.el6ost | RHSA-2014:0089 |
| Red Hat OpenStack 3 | python-keystone +2 | 2013.1.5-2.el6ost | RHSA-2014:0368 |
Advisories 2
- RHSA-2014:0368 Red Hat Security Advisory: openstack-keystone security update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2014:0089 Red Hat Security Advisory: openstack-keystone security and bug fix update Red Hat Security Advisories (RHSA) · Jan 14, 2026
References
- USN-2061-1 vendor-advisory
- 64253 vdb-entry
- [oss-security] 20131211 [OSSA 2013-032] Keystone trust circumvention through EC2-style tokens (CVE-2013-6391) mailing-list
- 56154 third-party-advisory
- 56079 third-party-advisory
- RHSA-2014:0089 vendor-advisory
- https://bugs.launchpad.net/keystone/+bug/1242597
- keystone-cve20136391-sec-bypass(89657) vdb-entry