CVE-2013-1865

Published: 20 March 2013

OpenStack Keystone Folsom (2012.2) does not properly perform revocation checks for Keystone PKI tokens when done through a server, which allows remote attackers to bypass intended access restrictions via a revoked PKI token.

Notes

Keystone on 11.10 is a pre-release version and unusable with other
components such as nova and horizon
requires non-standard configuration (ie, using PKI tokens instead
of UUID)
per upstream, grizzly is not affected
Essex does not support PKI tokens and is therefore not affected

Status

References

• https://ubuntu.com/security/notices/USN-1772-1
• https://www.cve.org/CVERecord?id=CVE-2013-1865
• NVD
• Launchpad
• Debian

Bugs

• https://bugs.launchpad.net/bugs/1129713