Search for packages
| purl | pkg:deb/debian/keystone@2014.1.2.1-1?distro=trixie |
| Vulnerability | Summary | Fixed by |
|---|---|---|
| This package is not known to be affected by vulnerabilities. | ||
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-h1xa-f7tm-tudx | OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated users to retain access via a domain-scoped token for that domain. |
CVE-2014-5253
GHSA-77w8-qv8m-386h PYSEC-2014-109 |
| VCID-hjrj-k1wk-jbha | The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token. |
CVE-2014-5251
GHSA-gmvp-5rf9-mxcm PYSEC-2014-107 |
| VCID-s3gc-cxxf-63ed | The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/. |
CVE-2014-5252
GHSA-v8fq-gq9j-3v7h PYSEC-2014-108 |