CVE-2014-2237 — Vulnetix

CVE-2014-2237 REJECTED

The memcache token backend in OpenStack Identity (Keystone) 2013.1 through 2.013.1.4, 2013.2 through 2013.2.2, and icehouse before icehouse-3, when issuing a trust token with impersonation enabled, does not include this token in the trustee's token-index-list, which prevents the token from being invalidated by bulk token revocation and allows the trustee to bypass intended access restrictions.

EPSS 0.19% · 40.5th percentile

Risk Scores

EPSS Score

0.19%

40.5th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:14.04:LTS	keystone	0, 1:2013.2~rc4-0ubuntu1, 1:2013.2-0ubuntu1

Exploit Intelligence

[oss-security] 20140304 [OSSA 2014-006] Trustee token revocation does not work with memcache backend (CVE-2014-2237) (circl)
65895 (circl)
https://bugs.launchpad.net/keystone/+bug/1260080 (circl)
RHSA-2014:0580 (circl)

Timeline

Apr 1, 2014 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 20, 2022 EPSS Score
Jul 12, 2022 EPSS Score
Sep 3, 2022 EPSS Score
Oct 26, 2022 EPSS Score
Dec 18, 2022 EPSS Score
Feb 8, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 2, 2023 EPSS Score
May 25, 2023 EPSS Score

References

https://ubuntu.com/security/CVE-2014-2237 third-party-advisory
http://www.openwall.com/lists/oss-security/2014/02/28 third-party-advisory
http://lists.openstack.org/pipermail/openstack-announce/2014-March/000204.html third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2014-2237 third-party-advisory

Open in Interactive Console →