Описание
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.
A flaw was found in OpenStack Keystone. The federated token rescoping mechanism does not correctly propagate the original token's expiry to newly issued tokens. This allows a federated user to repeatedly rescope a token before it expires, effectively maintaining indefinite access and bypassing configured token lifetime policies. This vulnerability can lead to unauthorized persistent access to resources.
Отчет
This MODERATE token lifetime bypass in Keystone affects federated identity deployments (SAML2, OIDC). Authenticated users can maintain indefinite access by repeatedly rescoping tokens before expiry. High complexity reflects the federated identity requirement. Impact is low confidentiality and integrity as this maintains existing access rather than gaining new privileges. Fixed in version 29.0.2.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat OpenStack Platform 13 (Queens) | rhosp13/openstack-keystone | Fix deferred | ||
| Red Hat OpenStack Platform 16.2 | openstack-keystone | Fix deferred | ||
| Red Hat OpenStack Platform 16.2 | rhosp-rhel8/openstack-keystone | Fix deferred | ||
| Red Hat OpenStack Platform 17.1 | openstack-keystone | Fix deferred | ||
| Red Hat OpenStack Platform 17.1 | rhosp-rhel9/openstack-keystone | Fix deferred | ||
| Red Hat OpenStack Platform 18.0 | openstack-keystone | Fix deferred | ||
| Red Hat OpenStack Platform 18.0 | rhoso/openstack-keystone-rhel9 | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
4.9 Medium
CVSS3
Связанные уязвимости
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.
An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone federated token rescoping mechanism does not propagate the original token's expiry to the newly issued token. When a federated user rescopes a token via POST /v3/auth/tokens, the handle_scoped_token() function in the mapped authentication plugin returns response data without an expires_at value. The token provider falls back to issuing a token with a fresh default TTL. By rescoping repeatedly before each token expires, a user can maintain access indefinitely, bypassing operator-configured token lifetime policies. This is a variant of CVE-2012-3426. Only deployments using federated identity (SAML2, OpenID Connect) are affected.
An issue was discovered in OpenStack Keystone before 29.0.2. The Keyst ...
OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued token
EPSS
4.9 Medium
CVSS3