{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2014-07-23T00:00:00", "descriptions": [{"lang": "en", "value": "The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2014-10-06T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "RHSA-2014:1121", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2014-1121.html"}, {"name": "RHSA-2014:1122", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2014-1122.html"}, {"tags": ["x_refsource_MISC"], "url": "https://bugs.launchpad.net/keystone/+bug/1347961"}, {"name": "USN-2324-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU"], "url": "http://www.ubuntu.com/usn/USN-2324-1"}, {"name": "[oss-security] 20140815 [OSSA 2014-026] Multiple vulnerabilities in Keystone revocation events (CVE-2014-5251, CVE-2014-5252, CVE-2014-5253)", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2014/08/15/6"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2014-5251", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "RHSA-2014:1121", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2014-1121.html"}, {"name": "RHSA-2014:1122", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2014-1122.html"}, {"name": "https://bugs.launchpad.net/keystone/+bug/1347961", "refsource": "MISC", "url": "https://bugs.launchpad.net/keystone/+bug/1347961"}, {"name": "USN-2324-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-2324-1"}, {"name": "[oss-security] 20140815 [OSSA 2014-026] Multiple vulnerabilities in Keystone revocation events (CVE-2014-5251, CVE-2014-5252, CVE-2014-5253)", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2014/08/15/6"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T11:41:47.701Z"}, "title": "CVE Program Container", "references": [{"name": "RHSA-2014:1121", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2014-1121.html"}, {"name": "RHSA-2014:1122", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2014-1122.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugs.launchpad.net/keystone/+bug/1347961"}, {"name": "USN-2324-1", "tags": ["vendor-advisory", "x_refsource_UBUNTU", "x_transferred"], "url": "http://www.ubuntu.com/usn/USN-2324-1"}, {"name": "[oss-security] 20140815 [OSSA 2014-026] Multiple vulnerabilities in Keystone revocation events (CVE-2014-5251, CVE-2014-5252, CVE-2014-5253)", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2014/08/15/6"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2014-5251", "datePublished": "2014-08-25T14:00:00", "dateReserved": "2014-08-15T00:00:00", "dateUpdated": "2024-08-06T11:41:47.701Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:openstack:keystone:2014.1:*:*:*:*:*:*:*", "matchCriteriaId": "D1D0FFC2-E748-4611-AB1A-EAF6F49F4212", "vulnerable": true}, {"criteria": "cpe:2.3:a:openstack:keystone:2014.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "10944579-0B9C-4493-86E0-F537EA97DA1D", "vulnerable": true}, {"criteria": "cpe:2.3:a:openstack:keystone:juno-1:*:*:*:*:*:*:*", "matchCriteriaId": "1776BC45-43E1-4EE3-B444-4DAA8D514B2B", "vulnerable": true}, {"criteria": "cpe:2.3:a:openstack:keystone:juno-2:*:*:*:*:*:*:*", "matchCriteriaId": "7C7DB928-BC40-452F-8BB1-E06D438ACBD5", "vulnerable": true}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*", "matchCriteriaId": "B5A6F2F3-4894-4392-8296-3B8DD2679084", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token."}, {"lang": "es", "value": "El controlador de los tokens MySQL en OpenStack Identity (Keystone) 2014.1.x anterior a 2014.1.2.1 y Juno anterior a Juno-3 almacena las marcas del tiempo (timestamps) con la precisi\u00f3n incorrecta, lo que causa que falle la comparaci\u00f3n de la caducidad para los tokens y permite a usuarios remotos autenticados conservar el acceso a trav\u00e9s de un token caducado."}], "id": "CVE-2014-5251", "lastModified": "2014-10-10T05:23:50.467", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.9, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2014-08-25T14:55:07.033", "references": [{"source": "cve@mitre.org", "url": "http://rhn.redhat.com/errata/RHSA-2014-1121.html"}, {"source": "cve@mitre.org", "url": "http://rhn.redhat.com/errata/RHSA-2014-1122.html"}, {"source": "cve@mitre.org", "url": "http://www.openwall.com/lists/oss-security/2014/08/15/6"}, {"source": "cve@mitre.org", "url": "http://www.ubuntu.com/usn/USN-2324-1"}, {"source": "cve@mitre.org", "url": "https://bugs.launchpad.net/keystone/+bug/1347961"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-255"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2014:1122", "cpe": "cpe:/a:redhat:openstack:5::el6", "package": "openstack-keystone-0:2014.1.2.1-2.el6ost", "product_name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6", "release_date": "2014-09-02T00:00:00Z"}, {"advisory": "RHSA-2014:1121", "cpe": "cpe:/a:redhat:openstack:5::el7", "package": "openstack-keystone-0:2014.1.2.1-1.el7ost", "product_name": "Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7", "release_date": "2014-09-02T00:00:00Z"}], "bugzilla": {"description": "openstack-keystone: revocation events are broken with mysql", "id": "1127259", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1127259"}, "csaw": false, "cvss": {"cvss_base_score": "4.9", "cvss_scoring_vector": "AV:N/AC:M/Au:S/C:P/I:P/A:N", "status": "verified"}, "cwe": "CWE-697->CWE-613", "details": ["The MySQL token driver in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 stores timestamps with the incorrect precision, which causes the expiration comparison for tokens to fail and allows remote authenticated users to retain access via an expired token.", "It was found that the MySQL token driver did not correctly store token expiration times, which prevented manual token revocation. Only OpenStack Identity setups configured to make use of revocation events were affected."], "name": "CVE-2014-5251", "package_state": [{"cpe": "cpe:/a:redhat:openstack:4", "fix_state": "Not affected", "package_name": "openstack-keystone", "product_name": "Red Hat OpenStack Platform 4"}], "public_date": "2014-07-23T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2014-5251\nhttps://nvd.nist.gov/vuln/detail/CVE-2014-5251"], "statement": "This issue does not affected openstack-keystone as shipped with Red Hat Enterprise Linux OpenStack Platform 4.0.", "threat_severity": "Low"}