42 lines
1.5 KiB
JSON
42 lines
1.5 KiB
JSON
{
|
|
"advisory": {
|
|
"date": "2014-03-04",
|
|
"description": "Morgan Fainberg from Metacloud reported a vulnerability in the Keystone memcache token backend. When a trustor issues a trust token with impersonation enabled, the token is only added to the trustor's token list and not to the trustee's token list. This results in the trust token not being invalidated by the trustee's token revocation (bulk revocation). This is most noticeable when the trustee user is disabled or the trustee changes a password. Only setups using the memcache backend for tokens in Keystone are affected.",
|
|
"id": "2014-006",
|
|
"title": "Trustee token revocation does not work with memcache backend",
|
|
"url": "http://lists.openstack.org/pipermail/openstack-announce/2014-March/000204.html"
|
|
},
|
|
"affects": [
|
|
{
|
|
"product": "keystone",
|
|
"version": "TODO"
|
|
}
|
|
],
|
|
"bugs": [
|
|
"1260080"
|
|
],
|
|
"notes": "",
|
|
"reporters": [
|
|
{
|
|
"company": "Metacloud",
|
|
"name": "Morgan Fainberg"
|
|
}
|
|
],
|
|
"reviews": [
|
|
"60743",
|
|
"75521",
|
|
"75526"
|
|
],
|
|
"schema_version": 1,
|
|
"vulnerabilities": [
|
|
{
|
|
"cve": "CVE-2014-2237",
|
|
"cvss": {
|
|
"base_score": "4.0",
|
|
"scoring_vector": "AV:N/AC:L/Au:S/C:N/I:P/A:N"
|
|
},
|
|
"cwe": "TODO",
|
|
"impact": "moderate"
|
|
}
|
|
]
|
|
} |