CVE-2013-2104

python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remote authenticated users to (1) retain use of a token after it has expired, or (2) use a revoked token once it expires.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:N/I:P/A:P
redhatCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 72%
VendorProductVersion
openstackpython-keystoneclient
𝑥
≤ 0.2.3
openstackpython-keystoneclient
0.2.2
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
keystone
bullseye
2:18.0.0-3+deb11u1
fixed
wheezy
not-affected
bookworm
2:22.0.0-2
fixed
sid
2:26.0.0-1
fixed
trixie
2:26.0.0-1
fixed
python-keystoneclient
bullseye
1:4.1.1-2
fixed
wheezy
not-affected
bookworm
1:5.0.1-3
fixed
sid
1:5.5.0-2
fixed
trixie
1:5.5.0-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
keystone
raring
not-affected
quantal
Fixed 2012.2.4-0ubuntu3.1
released
precise
not-affected
lucid
dne
python-keystoneclient
raring
Fixed 1:0.2.3-0ubuntu2.2
released
quantal
not-affected
precise
not-affected
lucid
dne
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-updates/2013-06/msg00198.html
http://rhn.redhat.com/errata/RHSA-2013-0944.html
http://www.openwall.com/lists/oss-security/2013/05/28/7
http://www.ubuntu.com/usn/USN-1851-1
http://www.ubuntu.com/usn/USN-1875-1
https://bugs.launchpad.net/python-keystoneclient/+bug/1179615
http://lists.opensuse.org/opensuse-updates/2013-06/msg00198.html
http://rhn.redhat.com/errata/RHSA-2013-0944.html
http://www.openwall.com/lists/oss-security/2013/05/28/7
http://www.ubuntu.com/usn/USN-1851-1
http://www.ubuntu.com/usn/USN-1875-1
https://bugs.launchpad.net/python-keystoneclient/+bug/1179615