affected:
- package:
    ecosystem: PyPI
    name: keystone
    purl: pkg:pypi/keystone
  ranges:
  - events:
    - introduced: 2012.2.0
    - fixed: 2013.1.4
    type: ECOSYSTEM
aliases:
- CVE-2013-4294
- GHSA-5qpp-v56f-mqfm
details: The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone)
  Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token
  revocation list with PKI tokens, which allow remote attackers to bypass intended
  access restrictions via a revoked PKI token.
id: PYSEC-2013-42
modified: '2024-11-25T18:35:18.357593Z'
published: '2013-09-23T20:55:00Z'
references:
- type: ADVISORY
  url: https://bugs.launchpad.net/keystone/+bug/1202952
- type: WEB
  url: http://osvdb.org/97237
- type: FIX
  url: http://seclists.org/oss-sec/2013/q3/586
- type: ADVISORY
  url: http://rhn.redhat.com/errata/RHSA-2013-1285.html
- type: ADVISORY
  url: http://secunia.com/advisories/54706
- type: ADVISORY
  url: http://www.ubuntu.com/usn/USN-2002-1