OpenStack Identity (Keystone) before 2013.2.4, 2014.x before 2014.1.2, and Juno before Juno-2 allows remote authenticated trustees to gain access to an unauthorized project for which the trustor has certain roles via the project ID in a V2 API trust token request.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade keystone | Jul 30, 2024 | Oct 26, 2014 |
| Oracle Solaris | — | Upgrade cloud/openstack/neutron to version 0.2013.2.3-0.175.2.1.0.5.0 on Solaris 11.2Upgrade library/python-2/jsonpatch to version 1.1-0.175.2.1.0.5.0 on Solaris 11.2Upgrade cloud/openstack/glance to version 0.2013.2.3-0.175.2.1.0.5.0 on Solaris 11.2Upgrade cloud/openstack/swift to version 1.10.0-0.175.2.1.0.5.0 on Solaris 11.2Upgrade cloud/openstack/cinder to version 0.2013.2.3-0.175.2.1.0.5.0 on Solaris 11.2Upgrade cloud/openstack/horizon to version 0.2013.2.3-0.175.2.1.0.5.0 on Solaris 11.2Upgrade cloud/openstack/keystone to version 0.2013.2.3-0.175.2.1.0.5.0 on Solaris 11.2Upgrade service/network/dnsmasq to version 2.68-0.175.2.1.0.5.0 on Solaris 11.2Upgrade library/python-2/jsonpatch-27 to version 1.1-0.175.2.1.0.5.0 on Solaris 11.2Upgrade cloud/openstack/nova to version 0.2013.2.3-0.175.2.1.0.5.0 on Solaris 11.2Upgrade library/python-2/jsonpatch-26 to version 1.1-0.175.2.1.0.5.0 on Solaris 11.2 | May 29, 2017 | Oct 26, 2014 |
| Ubuntu | — | Upgrade python-keystone | Nov 8, 2024 | Oct 26, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub