CVE-2014-2237: OpenStack Identity (Keystone) Trustee token revocations does not work with memcache backend
(updated )
The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee’s token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.
References
- bugs.launchpad.net/keystone/+bug/1260080
- github.com/advisories/GHSA-23x9-8hxr-978c
- github.com/openstack/keystone
- github.com/openstack/keystone/commit/813d1254eb4f7a7d40009b23bbadbc4c5cc5daac
- github.com/openstack/keystone/commit/a411c944af78c36f2fdb87d305ba452dc52d7ed3
- github.com/openstack/keystone/commit/b6f0e26da0e2ab0892a5658da281a065e668637b
- github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2014-105.yaml
- nvd.nist.gov/vuln/detail/CVE-2014-2237
- rhn.redhat.com/errata/RHSA-2014-0580.html
Code Behaviors & Features
Detect and mitigate CVE-2014-2237 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →