Description
The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | keystone | 2014.1.2.1-1 | — |
| Debian 13 | keystone | 2014.1.2.1-1 | — |
| Debian 12 | keystone | 2014.1.2.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | keystone | 1:2014.1.2.1-0ubuntu1.1 | USN-2324-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 5 | python-keystone +2 | 2014.1.2.1-1.el7ost | RHSA-2014:1122, RHSA-2014:1121 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | keystone | < 8.0.0a0 | 8.0.0a0 | GHSA-v8fq-gq9j-3v7h |
Advisories 3
- RHSA-2014:1122 Red Hat Security Advisory: openstack-keystone security and bug fix update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- RHSA-2014:1121 Red Hat Security Advisory: openstack-keystone security and bug fix update Red Hat Security Advisories (RHSA) · Aug 1, 2026
- USN-2324-1 keystone vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
References
- RHSA-2014:1121 vendor-advisory
- RHSA-2014:1122 vendor-advisory
- USN-2324-1 vendor-advisory
- https://bugs.launchpad.net/keystone/+bug/1348820
- [oss-security] 20140815 [OSSA 2014-026] Multiple vulnerabilities in Keystone revocation events (CVE-2014-5251, CVE-2014-5252, CVE-2014-5253) mailing-list