CVE-2014-5251: OpenStack Identity (Keystone) Multiple vulnerabilities in revocation events
(updated )
The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token.
References
- bugs.launchpad.net/keystone/+bug/1347961
- github.com/advisories/GHSA-gmvp-5rf9-mxcm
- github.com/openstack/keystone
- github.com/openstack/keystone/commit/6cbf835542d62e6e5db4b4aef7141b1731cad9dc
- github.com/openstack/keystone/commit/7aee6304f653475a4130dc3e5be602e91481f108
- github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2014-107.yaml
- nvd.nist.gov/vuln/detail/CVE-2014-5251
Code Behaviors & Features
Detect and mitigate CVE-2014-5251 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →