PKI Token Expiry Vulnerability in python-keystoneclient: CVE-2013-2104
Summary
CVE-2013-2104: python-keystoneclient before 0.2.4, as used in OpenStack Keystone (Folsom), does not properly check expiry for PKI tokens, which allows remote authenticated users to (1) retain use of a token after it has expired, or (2)... Affects python-keystoneclient versions < 1:0.2.5-1. Fixed in 1:0.2.5-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-keystoneclient is a client library for interacting with OpenStack Keystone, which provides identity services for cloud computing. It allows users to manage authentication and access control for cloud resources. The library is crucial for ensuring secure access to services, but it has a vulnerability that affects how it handles PKI tokens, specifically regarding token expiry and revocation.
Vulnerability Detail
The vulnerability identified as CVE-2013-2104 affects python-keystoneclient versions prior to 0.2.4. It does not properly check the expiry of PKI tokens, allowing remote authenticated users to continue using a token even after it has expired or to use a revoked token once it expires. This can lead to unauthorized access to cloud resources, posing significant security risks.
How To Fix
Minimum fixed version
1:0.2.5-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-keystoneclientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that your application implements additional checks for token validity and expiry on the application side, although this is not a substitute for upgrading the library.
Conclusion
The CVE-2013-2104 vulnerability in python-keystoneclient poses a serious risk by allowing the use of expired or revoked tokens. It is crucial to upgrade to version 1:0.2.5-1 or later to ensure the security of your cloud applications. Additionally, using tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for python-keystoneclient →
FAQ
CVE-2013-2104 is a vulnerability in python-keystoneclient that allows continued use of expired or revoked PKI tokens.
Versions of python-keystoneclient prior to 0.2.4 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Not fixing this vulnerability can lead to unauthorized access to sensitive cloud resources, potentially compromising data security and integrity.
Implement additional token validity checks in your application to mitigate risks until you can upgrade to a secure version.
Related vulnerabilities
Recent vulnerabilities recorded for python-keystoneclient.
