CVE-2014-3476 OpenStack Identity Keystone is vulnerable to Block delegation escalation of privilege

What is CVE-2014-3476?

CVE-2014-3476 is a medium-severity vulnerability in n/a, published on 17 Jun 2014. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

OpenStack Identity (Keystone) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-2 does not properly handle chained delegation, which allows remote authenticated users to gain privileges by leveraging a (1) trust or (2) OAuth token with impersonation enabled to create a new token with additional roles.

Weakness: CWE-269

Which versions are affected by CVE-2014-3476?

3 open source packages ship an affected version, including keystone. It affects 2 products.

Products include Openstack Keystone, Suse Cloud.

How do I fix CVE-2014-3476?

Upgrade keystone to 8.0.0a0 or later.

Is CVE-2014-3476 being exploited?

There is no known exploitation of CVE-2014-3476 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2020-12690 Insufficient Session Expiration in OpenStack Keystone High 8.8
• CVE-2019-19687 OpenStack Keystone Credential Leakage High 8.8
• CVE-2026-43001 OpenStack Keystone has an Incorrect Authorization Issue High 7.9
• CVE-2014-2828 OpenStack Identity (Keystone) DoS through V3 API authentication chaining High 7.8
• CVE-2021-38155 OpenStack Keystone allows information disclosure during account locking High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2014-3476, GHSA-274v-r947-v34r, PYSEC-2026-649, UBUNTU-CVE-2014-3476.