CVE-2022-2447
01.09.2022, 21:15
A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.Enginsight
| Vendor | Product | Version |
|---|---|---|
| openstack | keystone | - |
| redhat | openstack_platform | 16.1 |
| redhat | openstack_platform | 16.2 |
| redhat | quay | 3.0.0 |
| redhat | storage | 3.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Common Weakness Enumeration
- CWE-324 - Use of a Key Past its Expiration DateThe product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
- CWE-672 - Operation on a Resource after Expiration or ReleaseThe software uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.