CVE-2014-5253

Publication date 15 August 2014

Last updated 24 July 2024

Ubuntu priority

OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 does not properly revoke tokens when a domain is invalidated, which allows remote authenticated users to retain access via a domain-scoped token for that domain.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
keystone	14.04 LTS trusty	Fixed 1:2014.1.2.1-0ubuntu1.1
	12.04 LTS precise	Not affected
	10.04 LTS lucid	Not in release

How can I get the fixes?
What do statuses mean?
Patch details

Notes

jdstrand

Per upstream, revocation events added in Icehouse (Ubuntu 14.04 LTS)

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
keystone	Upstream: https://review.openstack.org/112084 Upstream: https://review.openstack.org/109820

References

MITRE
NVD
Launchpad
Debian

Related Ubuntu Security Notices (USN)

USN-2324-1
OpenStack Keystone vulnerabilities
21 August 2014

Other references

https://git.openstack.org/cgit/openstack/keystone/commit/?id=317f9d34b4da20c21edd5b851889298b67c843e1
https://www.cve.org/CVERecord?id=CVE-2014-5253