CVE-2013-6391

Currently unrated

Key Information:

Vendor: Openstack
Status: Keystone
Vendor: CVE Published:; 14 December 2013

Summary

The ec2tokens API in OpenStack Identity (Keystone) before Havana 2013.2.1 and Icehouse before icehouse-2 does not return a trust-scoped token when one is received, which allows remote trust users to gain privileges by generating EC2 credentials from a trust-scoped token and using them in an ec2tokens API request.

References

http://www.ubuntu.com/usn/USN-2061-1

vendor-advisoryx_refsource_UBUNTU

http://www.securityfocus.com/bid/64253

vdb-entryx_refsource_BID

http://www.openwall.com/lists/oss-security/2013/12/11/7

mailing-listx_refsource_MLIST

Timeline

Vulnerability published
Dec 14, 2013
Vulnerability Reserved
Nov 4, 2013