OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows remote authenticated users to retain access via the token.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, Grizzly before 2013.1.1, and Havana does not
    immediately revoke the authentication token when deleting a user through the Keystone v2 API, which allows
    remote authenticated users to retain access via the token. (CVE-2013-2059)

OpenStack Keystone was updated to fix (bnc#818596, CVE-2013-2059):
Keystone tokens not immediately invalidated when user is deleted.

First stable Grizzly update 2013.1.1

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Revoke tokens on user delete CVE-2013-2059

    - authtoken: Securely create signing_dir CVE-2013-2030

    - avoid potential disclosure in log files and restrict       /var/log/keystone/ CVE-2013-2006

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sam Stoelinga discovered that Keystone would not immediately invalidate tokens when deleting users via the v2 API. A deleted user would be able to continue to use resources until the token lifetime expired.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
432613	SCA: security update for keystone (GHSA-hj89-qmx9-8qmh)	Tenable Cloud Security	SCA Checks	Local	medium
432613	SCA: security update for keystone (GHSA-hj89-qmx9-8qmh)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
75006	openSUSE Security Update : openstack-keystone (openSUSE-SU-2013:0949-1)	Nessus	SuSE Local Security Checks	Local	medium
66596	Fedora 19 : openstack-keystone-2013.1.1-1.fc19 (2013-8023)	Nessus	Fedora Local Security Checks	Local	medium
66531	Fedora 18 : openstack-keystone-2012.2.4-3.fc18 (2013-8048)	Nessus	Fedora Local Security Checks	Local	medium
66495	Ubuntu 12.04 LTS / 12.10 / 13.04 : keystone vulnerability (USN-1830-1)	Nessus	Ubuntu Local Security Checks	Local	medium

Detections

Analytics

CVE-2013-2059

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium