CVE-2014-3476: OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege

May 13, 2022 (updated May 14, 2024)

OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonation enabled to create a new token with additional roles.

References

bugs.launchpad.net/keystone/+bug/1324592
github.com/advisories/GHSA-274v-r947-v34r
nvd.nist.gov/vuln/detail/CVE-2014-3476

Code Behaviors & Features

Detect and mitigate CVE-2014-3476 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →