Vulnerability Description
The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers, which allows remote authenticated users to bypass intended access restrictions and gain access to cloud resources by manipulating byte fields within a revoked token.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openstack | Keystonemiddleware | >= 1.5.0, <= 1.5.3 |
| Openstack | Keystone | >= 8.0.0, < 8.0.2 |
| Oracle | Solaris | 11.3 |
Related Weaknesses (CWE)
References
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
- http://www.securityfocus.com/bid/80498Third Party AdvisoryVDB Entry
- https://bugs.launchpad.net/keystone/+bug/1490804Issue TrackingThird Party Advisory
- https://security.openstack.org/ossa/OSSA-2016-005.htmlPatchVendor Advisory
- https://wiki.openstack.org/wiki/OSSN/OSSN-0062Vendor Advisory
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.htmlThird Party Advisory
- http://www.securityfocus.com/bid/80498Third Party AdvisoryVDB Entry
- https://bugs.launchpad.net/keystone/+bug/1490804Issue TrackingThird Party Advisory
- https://security.openstack.org/ossa/OSSA-2016-005.htmlPatchVendor Advisory
- https://wiki.openstack.org/wiki/OSSN/OSSN-0062Vendor Advisory
FAQ
What is CVE-2015-7546?
CVE-2015-7546 is a vulnerability with a CVSS score of 7.5 (HIGH). The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty be...
How severe is CVE-2015-7546?
CVE-2015-7546 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-7546?
Check the references section above for vendor advisories and patch information. Affected products include: Openstack Keystonemiddleware, Openstack Keystone, Oracle Solaris.