Every CVESearch/Get API key

CVE-2014-5252

OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events

4.9 MediumFix available

CVE-2014-5252 is a medium vulnerability (CVSS 4.9) in Openstack Keystone, published August 15, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.52%, the 74th percentile. Fixed in keystone 8.0.0a0.

What does this mean?
Severity
4.9 MediumCVSS 2.0, NVD
Exploit chance
1.52%EPSS, 74th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
8.0.0a0keystone +11 more

Description

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.

Exploit likelihood

1.52%Up 0.4 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
keystone
PyPI
before 8.0.0a0
8.0.0a0
keystone
Debian:12
before 2014.1.2.1-1
2014.1.2.1-1
keystone
Debian:13
before 2014.1.2.1-1
2014.1.2.1-1
keystone
Debian:14
before 2014.1.2.1-1
2014.1.2.1-1
openstack-keystone
Red Hat:openstack:5::el7
From an advisory covering 3 CVEs
before 0:2014.1.2.1-1.el7ost
0:2014.1.2.1-1.el7ost
openstack-keystone-doc
Red Hat:openstack:5::el7
From an advisory covering 3 CVEs
before 0:2014.1.2.1-1.el7ost
0:2014.1.2.1-1.el7ost
python-keystone
Red Hat:openstack:5::el7
From an advisory covering 3 CVEs
before 0:2014.1.2.1-1.el7ost
0:2014.1.2.1-1.el7ost
openstack-keystone
Red Hat:openstack:5::el6
From an advisory covering 3 CVEs
before 0:2014.1.2.1-2.el6ost
0:2014.1.2.1-2.el6ost
openstack-keystone-doc
Red Hat:openstack:5::el6
From an advisory covering 3 CVEs
before 0:2014.1.2.1-2.el6ost
0:2014.1.2.1-2.el6ost
python-keystone
Red Hat:openstack:5::el6
From an advisory covering 3 CVEs
before 0:2014.1.2.1-2.el6ost
0:2014.1.2.1-2.el6ost
keystone
Ubuntu:14.04:LTS
before 1:2014.1.2.1-0ubuntu1.1, plus listed versions
1:2013.2~rc4-0ubuntu11:2013.2-0ubuntu11:2013.2-0ubuntu1.11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu1
Show 7 moreShow less
1:2014.1~b3-0ubuntu21:2014.1~b3-0ubuntu31:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu11:2014.1.2.1-0ubuntu1
1:2014.1.2.1-0ubuntu1.1
keystone
Ubuntu:14.04:LTS
From an advisory covering 5 CVEs
before 1:2014.1.2.1-0ubuntu1.1, plus listed versions
1:2013.2~rc4-0ubuntu11:2013.2-0ubuntu11:2013.2-0ubuntu1.11:2014.1~b1-0ubuntu11:2014.1~b2-0ubuntu1
Show 7 moreShow less
1:2014.1~b3-0ubuntu21:2014.1~b3-0ubuntu31:2014.1~rc1-0ubuntu11:2014.1~rc2-0ubuntu11:2014.1-0ubuntu11:2014.1.1-0ubuntu11:2014.1.2.1-0ubuntu1
1:2014.1.2.1-0ubuntu1.1

What each source reports

NVD Score used4.9

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.

Record
CVE-2014-5252
CVSS 2.0
4.9 MediumAV:N/AC:M/Au:S/C:P/I:P/A:N
Weakness
CWE-255
Updated
2026-11-02
CVE ListNo score

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.

Record
CVE-2014-5252
Updated
2026-11-02
EUVDEUVD-2014-0028No score

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.

Record
EUVD-2014-0028
Updated
2026-11-03
GitHub AdvisoriesGHSA-v8fq-gq9j-3v7h7.1

OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.

Record
GHSA-v8fq-gq9j-3v7h
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-613
Updated
2026-11-02
OSVGHSA-v8fq-gq9j-3v7h7.1

OpenStack Identity (Keystone) UUID v2 tokens does not expire with revocation events

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.

Record
GHSA-v8fq-gq9j-3v7h
CVSS 4.0
7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
CWE-613
Updated
2026-11-02
OSVNo score

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.

Record
CVE-2014-5252
Updated
2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2014-5252No score

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.

Record
DEBIAN-CVE-2014-5252
Updated
2026-11-02
OSVPYSEC-2014-108No score

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.

Record
PYSEC-2014-108
Updated
2026-11-02
OSVUBUNTU-CVE-2014-5252No score

The V3 API in OpenStack Identity (Keystone) 2014.1.x before 2014.1.2.1 and Juno before Juno-3 updates the issued_at value for UUID v2 tokens, which allows remote authenticated users to bypass the token expiration and retain access via a verification (1) GET or (2) HEAD request to v3/auth/tokens/.

Record
UBUNTU-CVE-2014-5252
Updated
2026-11-02
OSVUSN-2324-1No score

keystone vulnerabilities

Steven Hardy discovered that OpenStack Keystone did not properly handle chained delegation. A remove authenticated attacker could use this to gain privileges by creating a new token with additional roles. (CVE-2014-3476)

Jamie Lennox discovered that OpenStack Keystone did not properly validate the project id. A remote authenticated attacker may be able to use this to access other projects. (CVE-2014-3520)

Brant Knudson and Lance Bragstad discovered that OpenStack Keystone would not always revoke tokens correctly. If Keystone were configured to use revocation events, a remote authenticated attacker could continue to have access to resources. (CVE-2014-5251, CVE-2014-5252, CVE-2014-5253)

Record
USN-2324-1
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 34 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open