CVE-2013-2104: python-keystoneclient Token Expiry Check Bypass
Summary
CVE-2013-2104: python-keystoneclient missing expiration check in PKI token validation. Affects python-keystoneclient versions < 0.2.4. Fixed in 0.2.4. How to fix ↓
Also tracked for
- python-keystoneclient · Debian:11
The same CVE-2013-2104 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python-keystoneclient is a Python library used in OpenStack Keystone (Folsom) for authentication and authorization. It provides a client interface to interact with the Keystone identity service. The library allows users to manage tokens, authenticate against Keystone, and perform various operations related to identity management. However, versions before 0.2.4 of python-keystoneclient have a vulnerability related to token expiry check.
Vulnerability Detail
The vulnerability (CVE-2013-2104) in python-keystoneclient allows remote authenticated users to exploit two scenarios. Firstly, they can retain the use of a token even after it has expired. This means an attacker can continue to perform actions on behalf of the authenticated user even when the token should no longer be valid. Secondly, the vulnerability allows the use of a revoked token once it has expired. This means an attacker can reuse a token that has been revoked by the system after its expiration. These issues can lead to unauthorized access and potential misuse of user privileges.
How To Fix
Minimum fixed version
0.2.4
This is the first release that contains the fix.
pip install --upgrade "python-keystoneclient==0.2.4"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually implement additional checks for token expiry and revocation in their application code. This can involve validating token expiration timestamps and ensuring that revoked tokens are not accepted for authentication or authorization. However, applying the official fix by upgrading python-keystoneclient is the recommended approach.
Conclusion
The vulnerability in python-keystoneclient allows remote authenticated users to bypass token expiry checks, potentially leading to unauthorized access and misuse of user privileges. To mitigate this issue, it is crucial to upgrade to python-keystoneclient version 0.2.4 or later. For further assistance and support in vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for python-keystoneclient →
FAQ
python-keystoneclient is a Python library used in OpenStack Keystone (Folsom) for authentication and authorization. It provides a client interface to interact with the Keystone identity service.
The vulnerability allows remote authenticated users to retain the use of expired tokens or reuse revoked tokens. This can lead to unauthorized access and potential misuse of user privileges.
To fix this vulnerability, upgrade python-keystoneclient to version 0.2.4 or later.
A workaround involves implementing additional checks for token expiry and revocation in application code. However, upgrading python-keystoneclient is the recommended approach.
For more information, refer to the official advisory at https://github.com/pypa/advisory-database/blob/main/vulns/python-keystoneclient/PYSEC-2014-69.yaml
Related vulnerabilities
Recent vulnerabilities recorded for python-keystoneclient.
