CVE-2013-2104 python-keystoneclient missing expiration check in PKI token validation
Authenticated users can bypass token expiration and revocation checks in the OpenStack Keystone client, retaining unauthorized access.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-2104?
CVE-2013-2104 is a medium-severity vulnerability in n/a, published on 21 Jan 2014. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remote authenticated users to (1) retain use of a token after it has expired, or (2) use a revoked token once it expires.
Weakness: CWE-264
Which versions are affected by CVE-2013-2104?
3 open source packages ship an affected version, including python-keystoneclient. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
python-keystoneclient PyPI | All versions | 0.2.4 |
python-keystoneclient PyPI | All versions | 0.2.4 |
python-keystoneclient PyPI | All versions | 0.2.4 |
Linux distribution packages (2)
python-keystoneclient Red Hat:openstack:3::el6 | All versions | 1:0.2.3-2.el6ost |
python-keystoneclient-doc Red Hat:openstack:3::el6 | All versions | 1:0.2.3-2.el6ost |
Products include Openstack Python-Keystoneclient.
How do I fix CVE-2013-2104?
Upgrade python-keystoneclient to 0.2.4 or later.
Is CVE-2013-2104 being exploited?
There is no known exploitation of CVE-2013-2104 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as DEBIAN-CVE-2013-2104, GHSA-4rrr-j7ff-r844, PYSEC-2014-69, RHSA-2013:0944.