There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly
    before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote
    attackers to bypass intended access restrictions via a revoked PKI token. (CVE-2013-4294)

Chmouel Boudjnah 發現，租戶停用時 Keystone 未正確讓使用者 token 失效，進而允許經驗證的使用者透過 token 取得存取權。(CVE-2013-4222)

Kieran Spear 發現，當使用 memcache 和 KVS 後端時，Keystone 在執行撤銷時未正確驗證 PKI token。經驗證的攻擊者可惡意利用此弱點，藉此繞過預定的存取限制。(CVE-2013-4294)。

Chmouel Boudjnah 发现 Keystone 在禁用了某个租户时未正确使用户标记失效，这允许经过认证的用户通过标记保留访问权限。(CVE-2013-4222)

Kieran Spear 发现 Keystone 在使用 memcache 和 KVS 后端执行吊销时未正确验证 PKI 标记。经过认证的攻击者可利用此问题绕过预期访问限制。(CVE-2013-4294)。

遠端 Redhat Enterprise Linux 6 主機上安裝的套件受到 RHSA-2013:1285 公告中提及的弱點影響。

  - OpenStack：使用 Keystone memcache/KVS 後端時發生 Keystone Token 撤銷失敗 (CVE-2013-4294)

請注意，Nessus 並未測試此問題，而是僅依據應用程式自我報告的版本號碼作出判斷。

远程 Redhat Enterprise Linux 6 主机上安装的程序包受到 RHSA-2013:1285 公告中提及的漏洞影响。

  - OpenStack：使用 Keystone memcache/KVS 后端时发生 Keystone 令牌撤消失败 (CVE-2013-4294)

请注意，Nessus 尚未测试此问题，而是只依据应用程序自我报告的版本号进行判断。

リモート Redhat Enterprise Linux 6 ホストに、RHSA-2013:1285 アドバイザリに記載されている脆弱性の影響を受けるパッケージがインストールされています。

  - OpenStack: Keystone memcache/KVS バックエンドを使用した Keystone トークン失効の失敗 (CVE-2013-4294)

Nessus はこの問題をテストしておらず、代わりにアプリケーションが自己報告するバージョン番号にのみ依存していることに注意してください。

Chmouel Boudjnah 氏は、テナントが無効にされたときに、Keystone が適切にユーザートークンを無効にしないことを発見しました。これにより、認証されたユーザーが、トークンによりアクセスを保持する可能性がありました。(CVE-2013-4222)

Kieran Spear 氏は、memchache と KVS バックエンドの使用時に取消を実行する際、Keystone が PKI トークンを適切に検証しないことを発見しました。認証された攻撃者がこれを悪用して、意図されたアクセス制限をバイパスする可能性があります。（CVE-2013-4294）。

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2013:1285 advisory.

    The openstack-keystone packages provide Keystone, a Python implementation     of the OpenStack identity service API, which provides Identity, Token,     Catalog, and Policy services.

    It was found that Keystone did not correctly handle revoked PKI tokens,     allowing users with revoked tokens to retain access to resources they     should no longer be able to access. This issue only affected systems using     PKI tokens with the memcache or KVS token back ends. (CVE-2013-4294)

    Red Hat would like to thank Thierry Carrez of OpenStack upstream for     reporting this issue. Upstream acknowledges Kieran Spear of University of     Melbourne as the original reporter.

    All users of openstack-keystone are advised to upgrade to these updated     packages, which correct these issues. After installing the updated     packages, the Keystone service (openstack-keystone) will be restarted     automatically.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Chmouel Boudjnah discovered that Keystone did not properly invalidate user tokens when a tenant was disabled which allowed an authenticated user to retain access via the token. (CVE-2013-4222)

Kieran Spear discovered that Keystone did not properly verify PKI tokens when performing revocation when using the memcache and KVS backends. An authenticated attacker could exploit this to bypass intended access restrictions. (CVE-2013-4294).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	名稱	產品	系列	已發布	已更新	嚴重性
410982	SCA: security update for keystone (GHSA-5qpp-v56f-mqfm)	Tenable Self-Hosted Container Security	SCA Checks	2025/1/23	2026/7/2	medium
410982	SCA: security update for keystone (GHSA-5qpp-v56f-mqfm)	Tenable Cloud Security	SCA Checks	2025/1/23	2026/7/2	medium
70581	Ubuntu 12.10 / 13.04：keystone 弱點 (USN-2002-1)	Nessus	Ubuntu Local Security Checks	2013/10/24	2019/9/19	medium
70581	Ubuntu 12.10 / 13.04：keystone 漏洞 (USN-2002-1)	Nessus	Ubuntu Local Security Checks	2013/10/24	2019/9/19	medium
193676	RHEL 6：openstack-keystone (RHSA-2013:1285)	Nessus	Red Hat Local Security Checks	2024/4/21	2024/6/3	high
193676	RHEL 6：openstack-keystone (RHSA-2013:1285)	Nessus	Red Hat Local Security Checks	2024/4/21	2024/6/3	high
193676	RHEL 6 : openstack-keystone (RHSA-2013:1285)	Nessus	Red Hat Local Security Checks	2024/4/21	2024/6/3	high
70581	Ubuntu 12.10：keystone 脆弱性（USN-2002-1）	Nessus	Ubuntu Local Security Checks	2013/10/24	2019/9/19	medium
193676	RHEL 6 : openstack-keystone (RHSA-2013:1285)	Nessus	Red Hat Local Security Checks	2024/4/21	2024/6/3	high
70581	Ubuntu 12.10 / 13.04 : keystone vulnerabilities (USN-2002-1)	Nessus	Ubuntu Local Security Checks	2013/10/24	2019/9/19	medium

偵測

搜尋 Plugin

medium

medium

medium

medium

high

high

high

medium

high

medium