Executive brief
OpenStack Keystone is an identity and authentication service used to manage user access and permissions in cloud environments. A flaw in how it validates revoked PKI tokens allows users whose access should have been terminated to retain access to cloud resources and services, posing a risk to system and data security.
Technical details
The vulnerability is an improper authentication issue (CWE-287) in OpenStack Keystone Folsom (2012.2) where the server-side revocation check for PKI tokens is not properly performed. An attacker with a revoked PKI token can bypass intended access restrictions and retain unauthorized access to resources. The attack requires network access to Keystone but no prior authentication—the revoked token itself is the attack vector. The vulnerability was introduced in version 2012.2 and fixed in version 2012.2.4. Patches are available via Red Hat's advisory RHSA-2013:0708 and upstream OpenStack project fixes.
Affected products
- OpenStack Keystone 2012.2 to 2012.2.3
Timeline
- 2013-03-22: disclosed
- 2013-04-04: patched: Red Hat advisory RHSA-2013:0708 released
- 2022-05-17: advisory: GHSA-22q6-wwq7-2jj9 published