CVE-2013-4294 json
OpenStack Identity (Keystone) allows remote attackers to bypass intended access restrictions via revoked PKI token
published 2013-09-23 13 y ago modified 2026-06-16 4 mo ago also GHSA-5qpp-v56f-mqfm , PYSEC-2013-42 , EUVD-2013-0017
- cvss
- 5.3
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.7%
- EPSS 2.7% chance of exploitation in 30 days, percentile 86%
- public exploits
- 0
- none known
Summary
The (1) mamcache and (2) KVS token backends in OpenStack Identity (Keystone) Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remote attackers to bypass intended access restrictions via a revoked PKI token.
Patch / fix
- pypi keystone 2013.1.4
- keystone Debian 14, Debian 13, Debian 12 2013.1.3-2
debian advisories DEBIAN-CVE-2013-4294
- openstack-keystone openstack 3 2013.1.3-2.el6ost
- python-keystone openstack 3 2013.1.3-2.el6ost
red hat advisories RHSA-2013:1285
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2013-4294 updated cvss 4.0
OpenStack: Keystone Token revocation failure using Keystone memcache/KVS backends
-
Red Hat OpenStack Platform 4 openstack-keystoneaffected: no fix available
-
Red Hat Enterprise Linux OpenStack Platform 3.0 python-keystone 2013.1.3-2.el6ost, openstack-keystone 2013.1.3-2.el6ostfixed: vendor fix RHSA-2013:1285
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
Exploit prediction
2.70% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:P/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | keystone | >=2012.2.0, <2013.1.4 |
2013.1.4 |
Classification
- Weakness
-
- CWE-264 Permissions, Privileges, and Access Controls
References
-
seclists.org
/oss-sec/2013/q3/586
mailing-list, web, patch
-
ubuntu.com
/usn/USN-2002-1
vendor-advisory, web, advisory
-
rhn.redhat.com
/errata/RHSA-2013-1285.html
vendor-advisory, web, advisory
-
bugs.launchpad.net
/keystone/+bug/1202952
web, vendor-advisory, advisory
-
osvdb.org
/97237
vdb-entry, web
-
secunia.com
/advisories/54706
third-party-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2013-4294
advisory
-
access.redhat.com
/errata/RHSA-2013:1285
web
-
access.redhat.com
/security/cve/CVE-2013-4294
web
-
bugzilla.redhat.com
/show_bug.cgi?id=1004452
web
-
github.com
/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2013-42.yaml
web
-
opendev.org
/openstack/keystone
package
Sources
- CVE List CVE-2013-4294
- GitHub Advisory GHSA-5qpp-v56f-mqfm
- NVD CVE-2013-4294
- OSV PYSEC-2013-42
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.